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General remarks.— a. In the first nine chapters of this text 
ve have treated only those pwlodlc polyalphahetlc systems ehlch Involve 
a relationship among the secondary alidiabets. This relationship Is brou^pit 
about by the VigenCTe properties of the basic cipher square, or the Identi- 
cal properties possessed by the interaction of sliding primary components. 

In the case of Porta systems, Vigenere-type properties also exist, but In 
a modified form. Since the Vlgenwe square incorporates cyclic permuta- 
tions of a basic cli^er component, the symmetry among the secondary al^ia- 
bets ^en related to the original primary plain component is visible or 
direct; If some other component is considered as the plain consonant, the 
relationships among the secondary ali^bets vlU be latent or Indirect. 

b. If Instead of a ci^ier square of interrelated alphabets there vas 
used a matrix of N different unrelated alphabets, of course no synsetry of 
any hind would be~manlfested. Therefore the initial solution of a crypto- 
gram In such a system would progress along the uaual lines of first princi- 
ples (i.e., factoring, assumptions of letters based on frequencies or 
vowel-consonant analysis, attack by the probable word method, etc.) until 
the entire cryptogram Is solved by the progressive synthesis of the plain- 
text message. The powerful tool of the reconstruction of the secondary 
alphabets by principles of direct or indirect symmetry Is here Inapplicable; 
therefore the plain text most be coaxed out "the hard way" In Its entirety, 
and any unrecovered values must remain unrecovered until further traffic 
establishes these latter values. 

e. If the N cipher alphabets of a system Involving unrelated alpha- 
bets are systematically-mixed sequences (e.g.. If these sequences are 
keyword-mixed sequences or transposltlon-mlxsd sequences based on differ- 
ent key words), then a partial recovery of the secondary alphabets ndg^t 
reveal what the situation Is, and thus make possible the reconstruction 
of the conplete secondary alphabets. If, however, the cipher alphabets 
axe composed of random-mixed sequences, no complete reconstruction would 
be possible until enough cipher text has been accumulated to permit of 
establishing all the values In all the alphabets. 
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d. Once the N basic sequences of a cryptosystem vlth unrelated 
alptaaEets are recons true ted ^ the solution of subsequent messages using 
the same sequences is a simple matter ^ even if the sequences are used 
in a different order, as will presently be demonstrated. 

75. Solution of a typical system involving unrelated alphabets.- - a. 
The cryptography of a typical cryptosystem Involving unrelated alphabets 
is quite simple. There are available N different alphabets, vhlch may be 
used In one of the foUovlng ways: (ij all of the alphabets are used in 

the same sequence, starting at the same point In the sequence; (2) all the 
ali^bets are used In the same sequence, but vlth different starting 
points; (3) all the aliAiabets are used, but in a different order, or (4) 
only a selection of a certain nuniber of alphabets Is made, the number and 
order of vhlch are determltted or controlled by a specific key. In Fig. 

80, below, ve have a total of 25 different cl^dier sequences^ of 26 letters 
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Figure 80. 



^ The sequences used in diis illustiauon are actually die sequences used in the obsolete U. S. A rm y 
Cipher Device, Type M-94, See in this connection Appendix 6, "Cryptographic Supplement. " 
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each In tbe form of 26-letter stripe; these strips fit horizontally into 
a frame vith space for up to 2^ strips, and at the top of the frame there 
is affixed a normal sequence in which the plaintext letters are to be 
found. If it were standard practice to select a certain fixed nuodber of 
strips for the cipher components, these cipher strips would be placed into 
the device in a predetermined order under the pOLalntext strip and the 
process of encryption and decryption would proceed as in any repeating-key 
cipher \xslng a matrix.^ 



b. In Fig. 8l there is illustrated the Inverse matrix derived ftrom 
the previous figure, shoving the plaintext equivalents for the 26 cipher 
letters. 
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cipher text 

ABCDEFGHIJKLMMOPQRSTUVWXYZ 
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Figure 8l. 



^ If 10 d'frcn’nt sequences were used for ihc cipher components, then the riumher of different permuta- 
tions of 25 things taken 10 at a uine is given by the formula -- - 11, 861, 676, 288, 000, 

or, eiqiressed in standard rnadiumarical notation, approximately 1.19x10^'^. If only 5 different sequences 
were used for titc cipher components, the number of different permutations is 6. 38x10^, if 15 sequences were 
used, the number would be 4. 27x10^^, if 20 were used, die number is 1. 29xl0^‘\ and if all ‘25 sequences 
v^tre. used, the number of permutations Is 25.' or 1. 55id0^^. However, die fearless cryptanalyst goes atiead 
and solves his problem anyway, in spite of and widi utter disregard fur die fearful magnitude of these awe- 
inspiring numbers. 
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From the two foregoing matrices, there be derived diagrams of limi- 
tations of the basic matrix. In Fig. 82a ve have a diagram of the j^gossJ^- 
ble ciphertext equivalents of idalntext letters, and in Fig. 82b ve have a 

Plain 

ABCDEFGHIJKLMNOFQRSTUVWXYZ 
B P C P B A ’g C 'T B r r g ~ A A ' A ’ A "g~ B" e' B P ' B A " B C 
CESGGBDDCC1DGDDCGEJ6HFECSD 
Impossible FFFIEDEEEDMGHEEHKJMHIGGDFE 
ciphers HIGJFKGHPENIMFFMLKOLOMJLEG 
IKIPHOKJUFPJONPPHQPMQOKOJI 
KMMQPPNMXLQKPOQQQRTOSROPLJ 
LNEURSP0YRRRRPR8TUUQTUPQNE 
PRTWTUQS S U X W S 8 T X V H R V X V T Z P 
QUV V ST UVZXTUV WXXW WV Q 
RXXWZXXYVYZXYY 8 

U Y Z Z Z Z U 

Z Z 

Figure 8^. 
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Figure 82b. 

diagram of the impossible xdaintext equivalents of ci|diertext letters. 
These two diagrams vlU be very useful in the analysis of cryptograms 
enciphered by means of these alphabets, once the basic sequences have 
been recovered frtm previous aneJLysls or by compromise. 
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e. If strip No. 1 were used In a periodic polyalphabetlc eryptogrsm 
involving n of the N avallahle sequences, the theoretical expectations of 
the ciphertext frequencies of the No. 1 strip of Fig. 8l would have the 
following relative distributional appearance: 



Sss^ai 9 e 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Thus, after having factored a periodic cipher In this system to the proper 
nuaiber of al|diabets, It Is clear that If strip No. 1 were Involved in any 
of the alphabets of the cryptogram, this fact could be recognized by the 
goodness of fit of one of the distributions with the distribution of the 
iheoretlcal elidiertext frequencies for strip No. 1 . In this feishlon, the 
entire array of the sequences of Fig. 8 l could be represented by the theo- 
retical ciphertext frequencies, as shown In Fig. 83, below (to a base of 

100): 

Theoretical ciphertext frecuencles 
ABCDBFQHIJKLMNOPQRSTUVWXYZ 

1 28863380093324130127722030^ 

2 31413336270028382227^300089 

3 383700362202400813948 13 3272 

4 323 13 ^704308282836312090027 

5 022340706381 13 4082279823303 

6 03400978 13 03220316782328342 

7 132632330130307842800927482 

8 130839372372802036301284420 

9 722342883 113 638293040070230 
10 9062201387323 13430702840832 

.11 382760830982041331322273040 
Q 12 434272072893133380028201306 
"13 332796312013042382000384287 
5*14 284700802134326037322331890 
£1^ 632240120308813794873320320 
”16 401133764983038202038322702 

17 306003302820137282427419338 

18 802904130827432732360238301 

19 0022637083 913 83122387340240 

20 273809683824022030420331137 

21 830774023334292002 13 8368012 

22 3042342882680 913 12303307720 

23 290373672300082880441312233 

24 2483283890377302 13 604213020 

25 822920 13 0013373403308247826 

Figure 83. 
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d. Let us use as an example the foUoving message intercepted on eui 
air force link: 



G S G P 0 
1 B J 5 S 
H K J Z J 
1 T N W G 
1 G B A G 
V 0 G 0 B 
H R V J B 



Q M H L M R 
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D Z P W C L 

I B N 0 Q H 

II V V u D 1 
y D ir H L V 
A i:. N J Q C 



D N N 


K 


Q D 


GAN 


K 


L Z 


S X N 


E 


G D 


V Q U 


Y 


Y Q 


S X w 


0 


0 E 


0 G C 


J 


J R 


Q A A 


G 


C 0 



NON way 

N B II S 0 K 

F P T T T G 

PIN I fl J 

V U I R C X 

Q R T Y G J 

V 0 P 



C B X T K X T 
G K B V L U a 
MV a M N N G 
SB 1 F 0 A I 
J H Z 0 K X H 
X G 0 V J 0 L 



Since the cryptogram factors to 10 alphabets, distributions are made 
accordingly, as follows: 



I: 










a _ 




A B C D 


£ 


F G H I 


J K L M N 0 P 


Q R S 


II: 






s 






III: 






B 


S - = 






A B C D 


£ 


F G H I 


J ic L M N 0 P 


Q R S 


IV: 








~ “ 




V: 


s 




B _ 


a a a 






A B C D 


E 


F G H I 


J K L M N 0 P 


Q R S 



VI: “ - “ 3 



T U 



T U 



T 0 



V W X Y Z 

V tf X Y Z 

V W X Y Z 



VII: 

VIII: 

IX: 

X: 



ABCOSFGHIJKLMNOPQHSTUVWXYZ 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 



e. Matching the distribution for the 1st alphabet against the sue 
cesslve rows of Fig. 83 , we obtain tne following: 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 



I : 


1 


1135 


1 


2 11 


2 1 


1 




%(l.l): 


8 


3 3 


3 


477 


4 




= 44 


1(1,2): 


4 


3 6 6 35 


2 


474 




8 


. 79 


1(1,3): 


3 


31810 


2 


694 


26 3 


7 


■ 91 


id, 4): 


3 


7 1215 


2 


612 


18 


2 


« 68 


i(I,5): 


2 


7 30 


1 


479 


4 3 




- 67 


J(I,6): 


4 


9 724® 


2 


l4 8 2 


4 8 


4 


■ 151 
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I 




On the 6th trial, the y value of 1^1 Is excellent when compared with 
Xm “ .0667(100x20) ■ 133.4 and * .0385(100x20) ■ 76.9; the % I.C. 
is here * 1.96. Having identified the strip (Ho. 6) associated 

with Alphabet I of the cryptogram, the letters of Alphabet 1 may be de- 
ciphered. Alphabet II of the cryptogram when matched with strip Ho. 1 
gives a X value of l44, which is the highest of the 25 posslole matchings; 
this is equivalent to a 4 of 1 . 87 , which likewise Is very satis- 
factory; and Alphabet III when matched with strip No. l4 gives a ^ of 153, 
which is a ^ I.C. of 1.99, very good indeed. At this point tlie cipher 
letters of the first three alphaoets of the cryptogram are decipnered, as 
follows : 



GSGPOQMHLM 


R 


D 


N 


H 


K Q D N 0 N 


W G Y C 


B Y T K 


X 


T 


A I 


R 








I 


S 


S 






0 R T 








I 


B 


J S 




B K Q X C 


F 


G 


A 


N 


K L Z N D H 


SOKGKBVL 


u 


H 


E 


N 


E 








T 


R 


Y 






RED 








H 


K 


J 


Z 


J 


D Z P W C 


L 


S 


X 


N 


E G D F P T 


TTGMVHMN 


N 


G 


N 


C 


£ 








G 


I 


N 






I A R 








I 


T 


N 


W 


G 


I B N 0 Q 


H 


V 


Q 


U 


Y Y Q P I N 


T B J 3 


_S I F 0 


A I 


£ 


A 


S 








N 


V 


I 






£ N £ 








I 


G 


N 


A 


G 


H V V L D 


I 


s 


X 


W 


0 D £ V U I 


R C X J 


H Z 0 K 


X 


a 


£ 


R 


S 








£ 


I 


N 






ION 








V 


0 


G 


0 


B 


Y D H H L 


V 


0 


G 


c 


J J R Q R T 


YGJXGDVJ 


0 L 


V 


£ 


R 








V 


£ 


R 






L R £ 








H 


R 


V 


J 


B 


A Z N C Q 


c 


Q 


A 


A 


G C 0 V 0 F 










N 


G 


F 








D 


B 


Y 















These decipherments certainly look like good plain text. 

f. We now continue the matching one more step. In testing the dis- 
tribution for Alphabet IV, we get a ^ of 112 (■ % I.C. of 1.^) against 
strip Ho. 10, a X of 106 (■ ^I.C. of 1.38) against strip No. 15, and a 
X of 100 (* % I.C. of 1 . 30 ) against strip No. I 7 . Decipherments of the 
letters of Alphabet IV on the hypothesis of either strip No. 10 or No. 15 
do not prodiice good plaintext tetragraphs, but when strip No. 17 is tried, 
good plaintext continuations of the trlgra'idis are manifested. Note the 
pentagraphi c re petition IBJSS; with the decipherment of the first three 
letters as the word ENEMf may be assumed and thxis by-pass further 

X~tcst matching. All that is required, after the first three alphabets 
have been deciphered, is to find what strip will yield an Mq for an S^, 
and, if there is more than one such strip, to find the one where S «. « Mp 
and also where Jc represents a vowel or an R or L (in the sequence HRVJq 
at position 181 of the message); that is, we test for a strip that yields 
"good" decipherments for Alphabet IV. In other words, after matching 3 
or 4 distributions, the plaintext fragments decrypted form a basis for 
word assumptions, with trials based on the plain-cipher limitations of 



COHfIDI i a'nAL 



225 



REF ID : A64554 



JOffFiDOiiaja : 



Figs. 82a and b. Ube ct^lete solution nov follows easily ^ and the order 
of the strips Is foiind to be 6-1-1^-17-11-20-4-9-22-24'; the message begins 
with the words AIR RECQNRAISSANCE. 

g. If a cryptogram Is not long enou£^ to be solved by the procedinre 
Just described; It me^ still succumb to attack by the probable word method. 
For example; let us assume the following short cryptogram Is at hand: 

OCXYD DLANL WBBYH SFOAI BNDZE CKSOF 

OCXCD LDNXI RCXBH 



The message has been Intercepted on circuits known to be passing adminis- 
trative traffic; so a nuniber of probable beginning words will be tried, 
among which are the following: 



ACKRGWlfDGE 

ADFISE 

ARRIVAL 

ATTENTION 

CANCEL 

CITE 

COMMANDING 

COMMUNICATION 



CONFIRM 

DEPARTURE 

DISCONTINUE 

EFFECTIVE 

EQUIPMENT 

E3UTIDITE 

FOLLCUING 

FOR 



FROM 
INFORM 
IN REPLf 
ORDERS 
OUR 

PARAPHRASE 

PREPARE 

PROCEED 



RECEIPT 

RECEIVE 

RECOMMEND 

REFEEiENCE 

REFERRING 

REPEAT 

REPORT 

REQUEST 



REQUIRE 

REQUISITION 

RERAD 

REURAD 

SEND 

STATUS 

SUPPLY 

VERIFY 



h. Referring to the diagram of Fig. 82b, we note that the first 
letter of the cryptogram, Oe, cannot represent ^ or Vp; this rules out 
the beginning words SEND, STATUS, SUPPLY, and VERIFY. The second letter 
of the cryptogram, Cq, cannot represent A, C, E, I, R, T, or X, so that 
25 more from the list of 40 words are eliminated. The third cipher letter, 
Xq, cannot represent L, M, 0, R, or U; therefore 7 more words are elimi- 
nated, leaving only CONFIRM, EFFECTIVE, EQUIPMENT, and INFORM remaining 
under consideration. Since the fourth cipher letter, Y^, cannot represent 
either JU or Op, this reduces the possibilities to either CCXIFIRM or 
EFFECTIVE; neither one of these words can be elirvinated by a continuation 
of the foregoing process. 

The possibilities of strip nuznbers for these two probable words 
are cus follows: 



Plain: CONFIRM 

Cipher: 0 C X Y D D L 

Strips: 6 1 ll» 17 3 20 2 

12 25 11 4 

21 



Plain: EFFECTIVE 

Cipher: OCXYDDLAN 

Strips: 1 4 6 20 8 18 2^ 23 10 
11 9 25 24 15 

22 23 



Since the cryptogram factors to 10 alphabets we will write out the cipher 
text on this width, and test the assumptions of strip numbers on other rows 
of the cipher text. Testing the word CONFIRM, with 6-1-14-17 as the first 
four strip numbers we get the following: 
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6 1 14 17 

OCXYDDLABL 

C 0 B F 

VBBYE8F0A1 

0 B 0 F 

BBBZBDK80F 

FLAB 

OCZCOLDBXI 

C 0 B 8 

R C X B M 

1 0 B X 

This eartalnly looks vromlslns. If Be at the next to last position is 
a null Xp, than Me night be another Xp null; Me ■ Zp on strips 7 and 11, 
hut only on strip U does (the fifw letter of tm eryptograsO eqpal 
Ip, so the eorreet atrip for the fifth position is Bo. 11. In short order 
we reeorer the entire neqjuenea of strips, which is the seas as that given 
in subpar. f, shore. 

If a probable word is to be tested sonewhere in the nessage, the 
position being uidmown, then the diagraa in Fig. 62a is useful. For instance, 
if the crib FL16HI FLAB is to be tested in the cryptogram given in subpar. 

£, it will be found that the only place where this crib will fit without a 
contradiction (i.e., an inpossible plain-cipher equivalency) is at the l$th 
position, beginning with the letters BBF... Where the period is known, the 
possible strip arrangensnts nay be tested against other cycles of the crypto- 
gran to reduce the key to a unlqiue set of strips, as in the exsnple in sub- 
par. i. When the period of a short cryptogram ccumot be detemined, the 
plaemnt of a crib will still yield a key, which, even if not unique, can 
be tested against the rest of the cipher text in the nanner described in 
subpar. 22f(2). 

76. Bolution of a second case.- - a. !Qae cxyptosysten which will now 
be treated Inrolvas a cipher device narketed in France in the 1930's under 
the nLsnoaer of "transposlteur k peznutations secz^tes"; Baudouln^ describes 
this device and shows one nethod of attack, albeit a weak one. This device. 
Illustrated in Fig. 64, conprlses a fTans in which 10 compound strips. 

Joined in the niddle, are slid vnrtically. The upper halves of the strips 
(Fig. 6^ nay be permuted among thenselves, and so nay the lower strips 
(Fig. 6^. Thus there are (I0l)x(10{) or 13,156,189,440,000 possible 
permutationa— a staggering nunber which apparently contributed so little to 
the inventor's Gallic exuberance. The secrecy inparted to nessages is, we 
leaxToi, "guaranteed absolute both nathenatically and in practice"; as for 
the device, "if lost it will not enable the finders to decipher Mssages 
that night be intercepted." 8tm epxwlng with pride, the Inventor goes on 
to say that since there are 13 trillion possibilities which must be tried 

3 Captain Roger Baudouln, Elements de Cryptographle. pp. 188-196. Paiis, 1939. 
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Figure 81|>. 

In order to read an intercepted message^ a trial -cuid-error procedure is 
rendered absolunent iatposaible. thus ''baffling all approaches in cryptana 
lytics used up to the present time." Stifling a slight yawn, we return 
to the device. i 
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b. lEhere are tvo fixed reading poaltiona on the device; the upper 
one la used for the plain text, while the lower one (26 letters below the 
first one) Is used for the cipher. In encryption, the 20 strips are first 
arranged according to a specific key; then the first 10 letters of the 
plain are aligned In the upper reading position, and their cl|Aier equiva- 
lents are found In the lower reading position. The same treatment Is then 
applied to the second set of 10 letters of the message, and so on. In 
decryption, after first arranging the strips according to the key for the 
message, the Inverse procedure Is followed, setting up the cipher text on 
the lower reading position and finding the plain text in the upper. 



Upper strips 

1234567890 

JWBPFZCRHM 

KXCQGBDSJN 

YAOIUEOAIE 

LZDRflCFIKF 

MBFSJDGVLQ 

hcgtkfhwmr 

AEUOYIUEOl 

PDHVLGJXRS 

QFJWMHKZPT 

RGKXNJLBQV 

EIYUAOYIUO 

SHLZPKMCRH 

TJMBQLNDSX 

VKRCRMFFTZ 

lOAYEUAOYU 

WLFDSNQGVB 

XMQFTPRHWC 

ZNRGVQSJXD 

OUEAIYEUAY 

BFSHWRTKZF 

CQTJXSVLBG 

DRVKZTWMCH 

UYIEOAIYEA 

FSWLBVXNDJ 

GTXMCVZPFK 

HVZNDXBQGL 



Figure 85 a. 
c. Now for some cryp 



Lower strips 



GQDLSXNVKT 

HRFMTZPHLV 

EUAEYUAIYO 

JSGNVBQXMW 

KTHPWCRZNX 

LVJQXDSBPZ 

lYElAYEOAU 

MtfKRZFTCQB 

NXLSBGVDRC 

PZMTCHWFSD 

OAIOEAIUEY 

QBNVDJXGTF 

RCPIfFKZHVG 

SDQXGLBJWH 

USOUIEOYIA 

TFRZHMCKXJ 

VGSBJNDLZK 

WHTCKPFMBL 

YIUYOIUAOE 

XJVDLQGNCM 

ZKWFHRHPDN 

BLXGNSJQFP 

AOYAUOYEUI 

CMZHFTKRGQ 

DNBJQVLSHR 

FPCKRWMTJS 

1234567090 

Figure 85 b. 
observations . 



( 1 ) First of all, this system yields a periodic polyalfAiabetlc en- 
cipherment of only 10 alphabets; any message enciphered by means of this 
device will always have a period of 10. 



I 
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(2) In order to take advantage of certain reduced telegraph rates, 
this system has been constructed so that vovels are enciphered by vovels, 
and consonants by consonants, so that the resulting cl]^r text Is pro- 
nounceable. Ihls Is penny vise and cipher foolish -vhat a wonderful asset 
in crib -placing! And — further to eoiqiound the cryptographic felony — no 
consonant will ever be enciphered by Itself. This system seems to have 
been designed for cryptanal^ls ! 

( 3 ) It is true that all 20 of the strips are different from each 
other, so that ve have vhat at first glance might seem to be "unrelated" 
aliAiabets. But on closer examination. It will be seen that all of them 
are but slight modifications of direct standard sequences. Taking upper 
strip No. 1 as an example, 

JKYLMNAPQRESTVIWXZOBCDUFGH, 
this may be decomposed as follows: 

JK LMN FQR STY WXZ BCD FGH 
y a e 1 o u 

All of the remaining 19 strips are, to our delight, constructed along 
similar lines. Thus, If ve compere upper strip No. 1 and lower strip 
No. 1, 



JKyLMNaPQReSTVlWXZoBCDuFGH 

GHeJKLlMNPoQRSuTVWyXZBaCDF 



ve note that ve actually have direct symmetry among the consonants 
(arranged In their normal alphabetical order) emd likewise among the 
vowels. This property Is one more cryptanalytlc boon bestowed upon us 
by the Inventor. 



d. As cm example of solution of a cryptogram produced by the 
transposlteur. let us assume that the following message Is at hand: 



Z K 0 K C 
X Y 0 C K 
B I Y Q K 
0 M G G Y 



I B W D T 
W 0 G Y D 
X B A T A 
Q X D £ D 



I P U A F 
B F D Y 0 
0 L S A C 



X 0 C N E 
X Q C Y A 
P W A X A 



J R Y M W 
Z R A N J 
T U Z Y Q 



G B E D J 
0 Z I Y J 
0 B E D K 



Since the consonants on the strips are arrcmged In their normal alphabetical 
order, ve should be able to use the method of completing the plain-component 
sequence for the 20 possible consonant generatrices.^ This ve do forthwith. 
The completion diagrams for the first five out of the 10 alphabets are cm 
follows: 



^ This easy general soluaon was overlooked by Baudouin, who employed a much less generally applicable 
merhod in his example which depended on a message beginning with a digraph composed of rwo consonants. 
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Gen. 


Alphabet 1 


Alxdiabet 2 


Alphabet 3 


Al^diabet 4 


Alphabet 3 


1 


tt TVPiF-pm 










2 


-9iSeBe¥- 




2 F3BH 




DGXUQjPR- 


3 


^ CLBDCnf 


4 MRTHINP 


0 GVCJ 


MPP/^T 


1 FHZMUiFS 


4 


0 EMCFSFX 


MOfFTtriVN 


0 OIDK 


■M/vmnmr 


3 GJBNMNGT 


5 


1 niDGFGZ 


■psmai^ 




2 PRHSVL 


1 HKGFNPHF 


6 


0 GFFBGHB 


^yxumB- 


VfWntM 


rst9 TnwJxt 




7 


B2GJBJG 


vauSlCZfiflL 


1 LBHH 


-SSKV3BI- 


vxwm^rmvir 

^w^rXT^BVBF 


8 


-JRHKJKD 


3 SXBNBTV 


0 MCJP 


1 SVIMZP 


4 LNGSRSLZ 


9 


KSJIKLF 


1 TZCFCVW 


vnwr\ 


HmiypTN 


3 MPHTB3MB 


10 


1 LTKMLMS 


vrnv\y\T^,w 


1 FFLR 


IFVUTiy/WP 


mP/VfSG 


11 


2 MVUIMNH 


-WGiBHB- 


1 QGM5 


1 WZFBDS 


1 PRKWVWFD 


12 


2 NWMPNPJ 


-3SG662fi- 


3 RHNT 


vp/wtawi 


OQT VUVniP 


13 




1 ZFEXHBC 


1 SJFV 


1 ZCBDGV 


qfm#7V«7Pn_ 

XI 


14 




-BGJVJGB- 


nmrrmj 


1 BDSFHH 


3 SVNBZSSH 


15 


4 BSqiSRSM 


OHKHKBF- 


1 VIBX 


OTBGJX- 


2 OWPCBCTJ 


16 


$ SCRTSTN 


-BJUBfSG- 


1 WM5Z 


Timrmnr 


tpy/MviT^nr 


17 


3 TDSVTVP 


HOBMSH- 


2 XN!IB 


0 FBHJIS 


1 WZBFDIWL 


18 


2 VFTUVWQ 


2 GUIBNHJ 


0 ZPFC 


-GJsaatB- 


XB8GFGXM 


19 




-HMP9P3K- 


0 BQfl) 


1 iKZLND 


aoffiwaM- 


20 


^nBwEQODDr 




1 CBXF 


0 JLBMPF 


-HOVJBJBP- 



The scores to the left of the eoluimis are the sums of the two-category 
weights described In subpor. 21^; even thou^ we are treating only the 
consonants, this scoring method suffices and there Is no need to devise 
specially any new weights. (For greater sensitivity, we could of course 
use the logj ^33 wel^d^ts treated In par. 34.) 

e. !nie generatrices with the hl^st scores are usuaed to be the 
corre?b ones,^ and the following decipherments result: 



^ In Alphabet 4 there ate two generauices with equal high scores, however. Generatrix No. 2 produces 
good consonant digraphs with Alphabet 3, whereas the digraplis produced by Generatrix No. 5 are not nearly 
as good. This Is shown by the centlban scores of logS 224 (cf. Table 15, Appendix 2, Military Cryptanalyncs , 
Part I) of 





LL 


NG 


DS 


PR 


R5 




73 


+ 73 + 


59 


+ 66 


+ 75 


whereas 


PL 


RG 


HS 


SR 


VS 




59 


4 48 f 


38 


■t 42 


-f 0 



of Generatrix No. 2 of Alphabet 4 as the correct one. 



346, 

187, thus confirming the choice 



c tm w mT is s c 



231 



REF ID:A64554 



- COHPIDia TTISir 



12345678 910 
ZKOKCIBVOI 
S M L L 

IPUAFXOCNS 
R N 

JRYMVGBEDJ 
C T H G 

XYOCKWOGYB 
B D 8 

BFDYOXQCYA 

TER 

ZRANJOZIYJ 
ST PR 

BIYQKXBATA 
T R 8 

0L8ACPWAXA 
HE L 

TUZYQOBEBK 
N E Z 

OMGGYGXDED 

PTE 

For the vowels, the plain-component conqiletlon method Is possible but too 
precarious; It Is usually too difficult to distinguish the rig^t answers 
from the wrong. ^ Ibe simplest thing, having established the consonants 
for some of the al^Aiabets, Is to Insert vowels in the word structures on 
the basis of contextual likelihood; one vowel correctly identified In a 
particular column will of c ourse I dentify all t he vow els In that column. 
Thus, In the diagram above, SMOILp ■ SMALL and CTBIiGp ■ CTING, etc. Aided 
as we are both by the plaintext fragments thus far decrypted, and by the 
consonant -vowel configuration of the rest of the text, the entire crypto- 
gram may now easily be solved, as foUows: 



g 

It IS interesting to point out that in Alphabet 3 where there are 6 vowels, completion of the vowel - 
sequences together wiiii the deciban scores based on logi 33 weights yields the fpllowii\g, in which the 
highest generatrix is the correct one: 

Gen. 

1 0 U Y 0 A Y 42 

2 UYAUEA43 

3 YASYIE46 

4 AEIAOI49 

5 EI0EU0 48 

6 I0UIYUl(2 
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I 123^5678 910 
ZKOKCIBWDT 
SMALLARM8F 

IPUAFXOCNE 

ISEIBTERDI 

JRYNWGBEDJ 

CTINOCROBS 

XYOCKWOGYD 

ROADSSEVER 

BFDYOXQCYA 

THRBETEREE 

ZRANJOZIYJ 

STOFRBQUES 

BIYQKXBATA 

TAIRSTRIKB 

OLSACPWAXA 

ONHILLNINB 

TUZYQOBSDK 

NXEEZBR08T 

OMGGYQXBED 

0PTH0MP80N 

f. All that remains new is the matter of the key, l.e., the specific 
arraniement of the upper and lower strips; given the plain text to the 
cipher, this Is a very easy natter. We xiote. In Figs. 6^ and b, that If 
8p Is found in upper strip No. 1, the only possible ci]^r equivalents 
(found In Fig. 85b on the same line vith Sp In Fig. 8^ are as follows: 

(lower strip nos.) 

123^567890 

Sp>QBNVDJXGTF 

Patently, 8p ■ Zq Is Impossible vith any comblaatlon involving upper strip 
No. 1. In fact. It Is compatible only with the following 7 out of the 100 
possible combinations of the strips for the first alphabet: 

(upper strip nos.): 2 ft ^ ^ ^ 2 2. 

(lower strip nos.): 3* 8^ 4* 1^ 6’ J* 5 

But, in Alphabet 1, Ip ■ le which should serve to cut down the 7 possi- 
bilities above; Ip ■ Iq In only three of the 7 cosiblnatlons given above, 

viz . , «, and Thiu, ve may limit the possible strip arrangements for 

3 o X 

the ten ali^bets to the following: 
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2 4 6 
3 ' 1 

1 
1 

I 2 0 

rh 

T 2 

i'l 
6 
ff 

I- 1 
1 2 
r 0 

Since there is only one poaelbility of a strip pair in Alphabets 
2 and 6, the positions of izpper strips Nos. 1 and 8 and lover strips Nos. 
1 and 8 are nov fixed. This neans that in Alj^bet 4 only the pair ^ 

- g • 

will reaain, as the upper atrip No. 8 in the pair ~ has already been used 
in Alphabet 6; slinllarly, in Al|diabet 10, only the pair 2 viU remain. In 
Alphabet 1, only j vlU remain; and since for Alphabets 8 and 9 ve must 
have either ^ and or Tice versa, the only strip pair that remains for 



Alphabet 


1 


(Sp 


•Ze, Ip 


- Jb)s 


Alphabet 


2 


(1% 


•Kc, Op 


■Xc)s 


Alphabet 


3 


(Rp 


•Db, Ap 


■ Ofe): 


Alphabet 


4 


(Ip 


-K^s, Ip 


• Ae): 


Alphabet 


5 


(Ip 


■ Ge, Bp 


■ Ob): 


Alphabet 


6 


(Tp 


-Xc, Ap 


■ le): 


Alphabet 


7 


(Rp 


■Be, Bp 


■ Oe)s 


Alphabet 


8 


(Mp 


-He, Op 


■ ^): 


Alphabet 


9 


(Sp 


-1\:, Bp 


-Ye): 


Alphabet 


10 


(Fp 


■ Te, Ip 


■Be): 



that for Alphabet 3 the only strip pair must 



Alphabet 7 is ^ Ibis 

0 * 7 

be g-, and that the only strip pair for Alphabet 9 is The strips that 

have been fixed are as foUovs: 



Alphabet 

1234367B9IO 



upper strips: 2 1 0 4 21 B £ 
lower strips: 3 1 ? 7 ? ^ 2 



2 

0 



The identity of the strip pairs for Alphabets8 and 9 cannot be determined 
uniquely in this particular example; Alphabet 8 is either 2 or 2, and 

Alphabet 9 la either £ or either combination viU deeii^r all crypto- 
grams sent in the same key as the one Just solved. 
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h. The foregoing solution is predicated on a knowledge of tbe 
device and its strips* If ve had not known anything about the device, 
a single cryptogram of fair length would have sufficed for solution with- 
out much difficulty, and the completely flUed-out reconstruction matrix 
(for the device as set up In Fig. 8k, for example) ml^t look like this: 

P: 

1 
2 



C: 5 
6 

7 

8 

9 

10 



Indirect symmetry extending to the plaintext line would have been nmnl- 
fested, and the foUcwlng chains (from lines 4 and 10, as an example) 
would have been recovered: 

(AEIOUY) (BRJZQHXPGWHFVMDTLCSK) 

The consonant chain. If decimated at an Interval of -Sf would yield the 
consonants In normal alphabetical order. Tbe matrix might thereupon be 
rearranged as follows: 



ABCDBFGHIJKLMHOPQRSTUVWXYZ 

AHJKELMHIPQR8T0VVXZBUCDFYG 

IXZB0CDFUGHJKLYHKPQRA8TVEW 

0MNPUQR8YTVHXZABCDF6EHJKIL 

UZBGYDFGAHJKLHEHPQRSITVWOX 

IR8T0VWXUZBCDFYGHJKLAMNPEQ 

IFGE0JKLUMNPQRY8TVVXAZBCED 

IKLN0NPQUR8TVWYXZBCDAFGHEJ 

ULMHYPQRA8TVWXEZBCDFIGEJ0K 

ULMNYPQRA8TVWXEZBCDF1GHJ0X 

YQR8ATVWEXZBCD1FGEJK0LMMUP 

Figure 86a. 
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Figure 86b. 

The cryptanalyst would make mental note of the direct sysnetry manifested 
In Fig. 86^ he would see that he could solve further cryptograms by a 
modification of the plain-c<»^aent sequence method as demonstrated In 
subpar. ^ and be might perhaps be forever blissfully unaware of the 
existence of tbe 10 permutable upper strips and the 10 permutable lower 
strips. In other words, even though he might never knew the exact me- 
chanical details of the system, he could still cryptanalyxe the traffic 
with ease. 81tuatlons of this sort are not at all uneomnon In operation- 
al cryptanalytlc prMtice. 
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77. Solution of a further exaaiale.— a. The system to be treated 
here Is one of the machine clidiers used by~7UKStES80iR, the maneuver eneiqy 
In U.S. Joint mansuvers and training exercises. This system is included 
here because in its cryptanalysis certain interesting and pedagogically 
▼aluable techniques coub into play, and furthermore some interesting 
applications of symmetry present themaelres, even thou£^ the alphabets 
of the machine are random, nonrelated alphabets. 

b. This eleetromeehanleal cipher machine is called the ZEN-40 in 
Aggressor nomenclature. The cryptographic principle embodies a poly- 
alphabetic substitution matrix of 2 ^ reciprocal nonrelated alphabets 
which are wired electrically in a bank of uniselector switches'^ in the 
machine's interior. These alphabets are of the Porta type, in lAieh 
there are two distinct "families" of 13 letters each; a latter in one 
family has as its equivalents only the 13 letters in the other family. 

The exact composition of the letters composing the two famUles is de- 
termined by the plugging of a small plugboard located on the front panel 
of the ZEN-40. Ihe plugboard serves a threefold purpose: (l) it deter- 

mines the composition of the two families; (2) it changes the Identity 
of the letters in the Intemally-vlred matrix into isomorphic equivalents 
of the rows of the matrix; and ( 3 ) it permutes the order of the rows of 
the basic matrix. These three aspects will be explained in detail sub- 
sequently. 

c. There are several procedures in using the ZEN-40, giving rise 
to a nuniber of different types of cryptosystems. The particular crypto- 
system with which we will be concerned in this discussion produces crypto- 
grams enciphered by polyalpbabetlc substitution of a period of 2 ?, with 25 
reciprocal, nonrelated. Porta-type alphabets. The two varjables in this 
cryptosystem are (l) the plugging which remains in force for a particular 
cryptoperiod (usually one dag^, and ( 2 ) the starting point (determined by 
a specific key) of the succession of the 25 alphabets. The specific key 
may be varied at will by the cipher clerk for each message; these keys 
are designated by Indicators consisting of a consonant -vowel dlgrai^ 
repeated, followed by a fixed letter (usually X), such as in the indicator 
groups BABAX, VSVBC, etc. 

d. In the solution of this cryptosystem, the initial cryptanalysis 
would be accomplished with a small volume of traffic u a polyalphhbetic 
sidsstitutlon cipher with 25 nonrelated alphabets, and during the course 
of solution the phenomena of reciprocity and the Porta-like families would 
have been observed and used to advantage* The sequence reconstruction 
matrix might lo(dc as in Fig. 87 , below, using any one of the alphabets 
arbitrarily as the starting point for "Alphabet 1" of the matrix; in this 
ease, the sequence of alphabets of a message with the indicator ?BABAX" 
has been used as a base. (All reciprocal values of recoveries have been 
filled in.) 

7 

Uniselector svrltches are multipole-multilevel switches such as those used in automatic dialing 
telephone systems. 
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Figure 87 . 

It Is noted that the 12 different equlyalente for Ap In the order In which 
they occur In the matrix are as foUova: FLIRYTUHFXWD; the 
eqiolvalents for Bp are XIFYMWLQU. These egalwalents for Bp are 
among the eqiilvalents for Ap, with the addition of Q, which Is the last 
letter comprising one fsoUy of 13 letters. It will also be noted that 
each row of the matrix contains letters exclusively troa. the one or the 
other of the two fhmllles of 13 ;^ thus with but only a few entries In the 
reconstruction matrix. It Is possible to segregate the two families with 
ease. In this case It Is therefore easy to Identify the families as 
(ABCSaEJKNOSVZ) and (DFILMFQRTUHXY). This matrix 
may be vlsuallBed as a FOrta-like matrix of 23 nonrelated alphabets, as 
illustrated in the fragmentary matrix below: 



ABCBGHJKHOSVZ 



1 


P X P Q M B U 


Y R 


2 


W B M Q L 


T X R Y U 


3 


P I X P L 


M U 


2k 




25 




■ ■Ml 



^ Each row of the matrix will contain from 9 to 13 different letters belonging to one family, because 
of the manner in which the Intemally-wiied matrix is constructed. 
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e. The van of aatrloee for subaeqtient periods vUl be related to 
those~bf Fig. 67, in that there viU be a BtusHA 8 i 0 ) 8 titutioa of the 
letters in a rov (i.e., preserving tbs idioaorphie pattern and. thus 
iaoaorphic to the original rov) , and a transposition or pemutation of 
the rows of the basic matrix. For example, rov ”6" of Fig. 87, which 
begins with tbs letters H M F R F F... might be shifted to the rov 
of a nev matrix, vith tbs identity of the letters changed toLLOCDD... 
The partially recovered plugging, i.e., the simple substitution alphabet 
(which applies to both tbs isomaxphie substitution and to the pemutation 
of the rows of the matrix) is then for this ease as follows: 

ABCDEFGHIJKLMHOPqRSTUVWXYZ 
«| 4 ": DX L C 



The MMFRFFof "at” will gotoLLDCDDof”(^"at the same posi- 
tion (i.e., starting in the same alphabet), ^ the two matrices actually 
start with the same alphabet; if the indicator system has not changed, a 
pair of messages with identical indicators in two eryptoperiods means that 
the relative starting points for tbs sequence of alphabets are identical. 

If the relative starting points of two reconstruction matrices are not the 
same, then the N M F R F F of row " 0 " of ”o( " will still gotoLLDCDD 
of row "X." of but at a displacement equivalent to tbs relative dis- 

placement between the starting points of the two matrices. 

f • In order to Illustrate the mechanics of this system, let us assume 
that we have solved some traffic in a cryptoperiod subsequent to that iden- 
tified by the matrix in Fig. 87* A portion of the reconstruction matrix 
for this ” period (denoting the matrix in Fig. 87 as belonging to the 
"o(" period) is shown below; the beginning point of the sequence of alpha- 
bets here tw is that for a ’PJIBAX” message. 




1 2 3 4 5 6 7 8 9 10 11 12 13 14 IS 16 17 18 19 20 21 2223 2425 

q q R s R X q a J o o q N p j m 
WEUFXCIFIT VH 

RLR ODOR J KRL RBS SB 



It is apparent l^om the foregoing that the "A” and ’V;” rows are in the 
same family, and that the two families for the ” |9 ” period are (A C F H 
IKSTUVVYZ)and(BDEGJLMNOPqRX). How we note the Idio- 
morphlc sequence of rov "A", beginning with q q R - - - R; this is identi- 
fied as the Isomorphic equivalent of row "M" of "di", as follows: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 222324 25 

(^)A:qqR XRxq gjo oqN p j m 

(fli)M:GGR JNBGNZ VAZ0ZG8HE AGO 

Fkxmi this we recover the foUowlng plugging (substitution alphabet): 

"P”: A B C D E F G E I J K L M E 0 P q R 8 T U V W X Y Z 

"qC: JV a 08ZEGN B 

And since the "A" row of " ” goes to the K" rov of "o( ", we may add 
this equivalent pair to the recovered plugging. 
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llov ve Bsgr taka row for example, of tbe " ^ ” matrix and 
tranaform it into its exact eqiuiTalente in texma of matrix "e< ”, as 
foUove: 

1 2 3 4 5 6 7 8 9 ion 12 1314 15161718 19 202122 23 24 25 

(P)G: RLR ODOB JBHRL BBS BB 

(oi)?: NHZZ ABB 8J JJ 

Row ”C" of ” may be identi;M.ed as row ”T” of Matrix ”u", which results 
in the foUoMlng additional 'values in both rows: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 2324 25 

(p) C: RLR ODOB JBBRL BBB BBO 

U)T: BKB ZBZC AJSBK SCJ JJZ 

Transferring the equivalent pairs from, the foregoing to our recovered 
plugging, including the pairs A( (^ ) ■ X(oi } and C( ^ ) ■ T(o< ) derived from 
the pennutation of the rows, we now have tbe following plugging recon- 
struction: 

A B C D E F G H I J K L N B 0 P Q R S T U V W X Y Z 
"flL”: MCTEJ V A KOBZHGB B 

h. of the basic theory has been demonstrated how the fore- 

going**procedures could be continued with other rows of a partially re- 
covered new matrix, permitting the easy reconstruction of the relative 
plugging between key periods. However, a partleLlIy recovered matrix of 
a new cryptoperiod is not a prerequisite for the reconstruction of the 
new plugging; a simple technique based upon a crib attack will now be 
demonstrated. This technique, involving an interesting application of 
synmetry in cross -equating between values of two different key periods, 
will be treated in the subparagraphs below. ^ 

1. Let us assume we have available, in a new key peri od, th e foUowlng 
message suspected of beginning with tbe opening stereotype TSFERENCB YOUR 
MESSiUSE”: 

BABAX PCBJJ ZBQIZ IJVDM HHZJI JDYFK 

HBBBF ABMLT JMZAD BBBPI UVJIQ 

The Indicator, BABAX, shows that the beginning of the sequence of alphabets 
starts at the same point in tbe cycle as the BABAX matrix in Fig. 87 for 
the earlier cryptoperlod. The recoverable letter -families are observed to 
be (ADBGOQRUY)and(CIJMPVZ},and also (F B) and (H B) which 
are as yet indetezmLnate as to which of the larger chains they be long . 

From this it is obvious that the next word of the crib is not "HUMBER”, 
since the 22d letter, I\», cannot represent Up because D and U are in the 
same family. 

^ Thli method was first pointed out to me by Me. William E. May. 
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J[. The matched plain -cipher of the crib is set down: 

1 2 3 4 S 6 7 9 10 11 12 13 14 15 16 17 18 19 20 

REFERENCEYOURHESSAGE 
PCNJJZSQIZIJVDMHHEJI 

In the l 6 th and 17 th positions j Sp ■ Hq. A search is made in the matrix 
of Fig. 87 for a repeated letter in these positions in one of the rows, 
but none is found. (The matrix has been only partially reconstructed, so 
this correspondence is still hidden.) Since there is also the vertical 
pair £p/le In positions 9 and 20 of the crib, a search is made in Fig. 87 
for corresponding repetitions in the 9th and 20th positions in one of the 
rows; such a correspondence is found in the "D" and "Z" rows. This means 
that, in the plugging for the new matrix ( ^ ), yAat is now En in used 

to be Dp (or Zp) In , and what is now Ic in (& used to be (or Dq) 
in A . Since the plugging effects a simultaneous transformation of both 
the plain and cipher elements of the basic matrix, whatever correspondenee 
exists in the plain between two matrxees will also exist in the cipher of 
the two matrices, iiius we may make the following diagram, assuming one of 
the possibilities^" above that Zp(oc) s Ep(p) and Del*^ ) ■ Ic((^): 

1 2 34 5 6 7 3 9 10 II 12 13 14 15 16 17 1819 20 

z z z z z z 

REFERENCEYOURMESSAGE 
0 D D 

FCNJJZSQIZIJVDMHHZJI 

Figure 88a. 

Note that we have placed a Z over every E (either plain or cipher) and 
likewise a D over every I (either plain or ci^ier) of the diagram. 

k. Now in position 2, Zp ( of the period) is found to equal Uq in 
ct , ty referring to the matrix of Fig. 87 ; likewise, Zp («l) in positions 
4, 6, and I 5 in Fig. 88a may be found, by referring to the corresponding 
columns in Fig. 87 , to equal Xe, Tq, and Uq ±n oi , These equivalencies are 
set down in Fig. 88^ below: 

1 2 3 4 5 fa 7 8 9 10 U 12 13 14 IS 16 17 18 19 20 
Plain (oi): Z Z Z Z Z Z 

Plain ( (i ) : REFERENCEYOURMESSAGE 
Cipher ( ot ) : "~U 3c 5 5“T S 5 

C10ier ((%): FCNJJZSQIZIJVDMHHZJI 

Figure 88b. 



Plain (o<): 
Plain ((»); 
Cipher ( ei. ) : 
Cipher (|%): 



IT 



Tliu selecnon of the possibility to be tried is arbitrary at this stage, if a wropg cqiuvjleiice is chosen. 



conflicts will develop during the course of the analysis. (See subpar. 77n. ) 




t 
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By transferring values Just derived (e.g., a U above C in tbe cifAier may 
be transferred, to other occurrences of U in either the cipher or the 
plain), ve obtain the fOUowing diagram: 



Plain ( oL ) : 
Plain ((»): 
Cipher (^ ): 
Cipher ( (t ) : 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 
ZZZUZ MZ Z 

REFEREHCEYOURMESSAGE 

“u SfiTr Dr'S M rTTST 

PCNJJZSQIZIJVDMHHZJI 



Figure 86c. 

We now look up the equivalents in Fig. 87 for X (in position U (pos. 
8 ), T(lO), D(U), M(lk), T(l8), and X(19), and ve record these new values 
in the diagram, gelding the foUovlng: 



Plain ( ^ ) : 
Plain ((3): 
Cipher ( ) : 
Cipher ( (% ) : 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 

Z ZEZ UZ SO MZ Z 

REFEREHCEYOURMESSAGE 
U XXT NDTDX AM TXD 

PCHJJZSQIZIJVDMHHZJI 



Figure 88 d. 



Since ve have Ep(oL) ■ R»(^ ) in position 3, an E nay be inscribed over 
the R in columns 1 and 1$, 'yielding new cipher values of Q and X in the 
corresponding positions in the "cipher ol " rov. ^Qie diagram is now as 
complete as ve can make it foe the moment with the crib alone; the fol- 
lowing is the result obtained: 



Plain (oi): 
Plain ( ^ ) : 
Cipher ( ) : 
Cli^r ( (2 ) : 



1 2 J 4 5 6 7 8 9 10 11 12 1.3 14 15 16 17 18 19 20 

EZ ZEZ UZ SOEMZ Z 

REFEREHCEYOURMESSAGE 
qU Snrf HDTDXLAM TXD 

PCHJJZSQIZIJVDMHHZJI 



Figure 68 e . 

1. From the foregoing, it is evident that the plugging for the ^ 
period (taking ^ as the base) thus far recovered is the following sub- 
stlcutlon: 



dL : A B C D E F G H I J K L H H 0 P Q R S T U V W X Y Z 
^:D IR VMQUPOZC JE 

Three more values could have been picked up (in columns 10, 18, and 19) 
if the matrix in Fig. 87 had been complete; any further values must now 
come from the exploitation of the rest of the message. 
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m. The entire cipher text Is written out on a width of 25, In the 
Banner of the dlagraas of Figs. 88a;-e^ and substituted values ftm the 
recovered plugging and from the basic natolx are nade throughout the mes- 
sage where possible. Thus: 



Plain (oL ): 
Plain ((%): 
Cipher ( oi ) : 
Cl]^r ( p ) : 



1 2 3 4 5 6 7 8 9 10 U 12 13 14 15 16 17 18 19 20 2122 2324 25 

BZ ZEZ UZ SOBMZ Z 

REFBREMCEYOURMESSAGE 

QU XZT NDTDXLAM TXDXA 

PCEJJZSQIZIJVDMHHZJIJDYFK 



Plain (oi }: 
Plain (p): 
Cli^r (o( ): 
Cli^r ( ) : 



123456789 10 11 1213 1415 1617 1819 20 21222324 25 

B SF EZU8EAW 

0 RECORD 



M X M T A 
HHBBFASMLTJMZAD 



Q D 0 L X D N 
BBPlUVJIQ 



Figure 6^. 



If now an Sp Is assumed as the last letter of the message plain text, the 
diagram above may be expanded to the following, irtileh will result in the 
recovery of four more equivalent pairs (F-F, G-N, K-H, W-B), In the plugging: 





Plain («^) 
Plain ((3) 
Cipher ( el ) 
Cipher ((%) 



1 2 3456789 1011 12 131415 16 17 1819 20 212223 24 25 

BZFZEZGUZ SOEMZWW Z K 

R E F E R B H C E Y 0 U R M E S S A G E H 

Q U G T V N 1) T b X L A M K K T X D X A 

PCEJJZSQIZIJVDMHHZJIJDYFK 



Plain (01 ): 
Plain (fi): 
Cl^ier ( ) : 
Cl]^r (|3): 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 2122 23 2425 

M G B SF EZUSEAW 

M R 0 RECORDS 

KG F WM XMT AG QDOLXDK 

HRBBFASMLTJNZADNBBPIUVJIQ 



Figure 8^. 



The solution would continue In this manner, with the exploitation of 
further plaintext assumptions or additional cl^er text. Any further 
fdalntext assumptions of letters or probable words In the context would 
of course be based on the 13 possible plaintext equivalents for any given 
cipher letter In this key period. 



n. In subpar. we started the diagram of Fig. 88a with the assump- 
tion that Zp(o^ ) ■ Ep((^ ) and De(o< } ■ IcT^ }; this subsequently proved to 
be correct, there being no conflicts In the equivalent pairs developed. 

If, however, we had started with the other possibility, Dp(oL ) « Ep(|3 ) 
and Zc(oi) ■Ic((i), Inconsistencies would have developed. For exai^e. 

In the early stages of analysis of this possibility, the following dia- 
gram would have been obtained: 
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Plain (oi): 
Plain ( (^ ) : 
Ciidier ( o( ) : 
CiiAier (|a): 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 

WD DHS ED DWCD MD 

REFEBEKCEYOURMESSAGE 
E SS XZ ZSOIC SZ 

PCEJJZSQIZIJVDMHHZJI 



Note that the tentative plugging D-U in coluicn 12 is inconsistent with 
the plugging D-E in other columns of the diagram. 



o. The examples of theoretical solution thus far demonstrated have 
Involired matrices vlth Identical starting points in the cycle of 2$ alpha- 
bets. If in the period ve had no message with the indicator BABAX (i.e., 
starting at the same relative point in the nev matrix as the start of the 
matrix in Fig. 87 ) , and ve had a crib in a message having an unknown 
starting point j ve vould have to search for isomorphism across all the 
columns consecutively, instead of searching the rows of specific columns 
as ve did in stibpar. Consider the foUovlng: 

REFERENCEY0URME8SAGE 

JJNZZZMLMWZXCUMEAXPX 



We note the Isomorphism in positions 4 and 6, and also 9 end. and ve 
search in the matrix in Fig. 87 for a row vlth identical letters spaced 
at a distance of 2, and also 6, as in the matched plain-cipher, above. 

The only one ve flnd^^ idiich fits both intervals is in the Z row, in posi- 
tions 6 and 8, and 11 and 17* Our diagram thus begins as follows: 



Plain (oL): 
Plain ( () ) : 
Cipher ( ) : 
Cl^r ( ) : 



3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 

z z z z 

REFERENCEYOURMESSAGB 
T T M M 

JJNZZZMLMWZXCUMEAXPX 



From here on the solution vould i^oceed as previously demonstrated. Note 
that the tvo pairs of identical letters enable us to arrive at once at the 
correct initial assunqption. Instead of having two or more possibilities 
from which to make an arbitrary choice as was the case in subpar. 



78 . Solution involving Isologs. — a. The possibilities for a suc- 
cessful attack on complex cj^tosystems^by the exploitation of Isologs is 
predicated upon the mechanics of the cryptosystems, and, usually, also upon 
the presence of special circumstances connected vlth the Isologs. Each 
case is usually a very special case, dependent upon the amount of cryptana- 
lytic technical information that can be derived f^om a particular Isolog 
situation. 



^ It is quite possible that if the matrix in Fig. 87 were coinpleiely reconstructed, we might have found 
one or two other rows (in other columns) with the properties we are seeking, in any case, the selections would 
be greatly restricted if we had two pairs of idenrical letters as in (lie case at hand. 
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b. It has been indicated in subfiar. 62i, hov the procedures of an 
attatls. on isologs nay be adapted to a ease of isologs InvolTlog tvo dif- 
ferent sets of unrelated j random alidiabets. For example, even if the two 
messages in siibpar. 62b were enciphered with 4 and 5 distinct unrelated 
alphabets respectlvely7 the procedures given in subpars. 62e to g could 
be used for solution. Thus a partial recovery of some of the alphabets 
of a system such as that described in subpar. 7^ vould be made possible 
by this special solution. 

c. In the case of the strip system described in par. J6, Isologs 
are generally not of much help in solution; but since the general solu- 
tion described in subpars. 76d and e is adequate for solving a single 
message, an Isolog attack is only of academic importance. Nevertheless, 
a pair of very short Isdogs ml£^t still be solvable in this system, if 
either the plain or the cipher strips are in a fixed order, and this 
order is known. 



d. Isdogs in a system such as the ZEN-40 described in par. 77 are 
agaln’lof not much assistance in arriving at a sdutlon, unless further 
special circumstances also exist. For Instance, if ve had in this system 
a pair of cross -period Isdogs (l.e., in two different pluggings) in which 
there were two sets of families, and if these families were known, an 
adaptation of the generatrix method is possible Let us suppose that 
in the following pair of isdogs. the families of Message "A” are known 
tobe(ABDEOHLUVWXYZ)and(CFIJKMNOPQRST),and 



Message "A" 



M 0 H 0 X 
H C Y Y S 
G K C C L 



0 B K X S 
G W W C B 
Z Z Z H X 



D C G W A 
Z Z X G X 
K G G B W 



M G V G H 
U U N C C 



U K 0 H L 
G H Z A M 



L P F Z D 
X T K V T 



Message 



R E R E X 

Y G X J 0 

Y S U R E 



8 F S B 0 
Y D P R U 
E T Y R U 



D Y A E T 
E T G F U 
T F G Q U 



Z H T F Z 
C L U B T 



C X B J F 
0 H V J W 



U X B T J 
J Y 8 S I 



the families of Message "B" are known to be (ACEGEIJKLMNOP) and 
(BDFQR8TUVWXYZ). Then by supejrii^slng Message "A" and ”B" and 
writing the common letters which can represent decipherments of the verti- 
cal pairs, we have the following diagram for the first 30 letters of the 
messages : 



Tlus situation may of course also arise in modified Porta systems. 
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1 a 3 4 “i 6 7 e 9 10 1112 13 14 15 16 17 18 19 20 21 22 23 24 26 2627 28 29 JO 

0BKXSDCGVAMGY6HITK0HLLPFZDHCYYS 

SFSBODYAETZHTFZCXBJFUXBTJYGXJO 

ACACBCAFFCAFCCCFAAFCCAACFCBCFB 

EIEIDIEQQIEQIIIQEEQIIEEIQIDIQD 

GJGJUJGRRJGRJJJRGGRJJGGJRJUJRU 

HKHKVKHSSKHSKKKSHHSKKHHKSKVKSV 

LMLMWMLTTMLTMMMTLLTMMLLMTMWMTW 



N 


N X N 


N 


N N N 


N N 


N 


N X N 


X 


0 


0 Y 0 


0 


0 0 0 


0 0 


0 


0 Y 0 


Y 


P 


P Z P 


P 


p p p 


p p 


p 


P Z P 


Z 



Figure 69> 



It la easily seen that^ by reading various levels of the generatrices, 
the cryptanalyst can decipher the first two words of the message as 
ENEMY PA3ROI£. The rest of the plain text can be obtained by following 
this procedure; the completion of the solution Is left to the student cus 
an exercise. Having the matched i^in and cipher, recovery of the plugging 
follows along the lines Indicated in subpers. 77i to o. 

79. Additional remarks. — a. The attack on a system such as that 
Illustrated In Fig. ik) Is simple because the plain component In this 

case Is the normal sequence; If the plain component had been any other 
fixed sequence that were known, the tables of plain-cipher limitations in 
Figs. 82a and b and the table of theoretical clidiertext frequencies in 
Fig. 83 would have to be modified accordingly. Instead of the normal se- 
quence, any one of the 25 nundsered strips In Fig. 80 could have been used 
as the plain component; this irauld coi^llcate the solution to the extent 
that the table of theoretical ciphertext frequencies would have to be com- 
piled for 25 X 2l|- or 600 different distributions, against which the unl- 
literal frequency distributions for a new cryptogram in this system must 
be tested. If the plain component were an entirely unknown sequence, dif- 
ferent from any of the 25 numibered strips, solution would be greatly com- 
plicated and would have to follow along the general lines Indicated In 
subpar. 7^^ since neither tables of plain-cipher limitations nor a table 
of theoretlceO. ciphertext frequencies could be constructed. This demon- 
strates that, even In a cryptosystem emplt^ng random cipher ca.pbabets, 
mn-iriTmim secuzlty is attained when the plain component is also a random 
sequence. 

b. If In a system such as that of Fig. 60, each of the cipher strips 
were slidable against the plain component so as to make possible the Jux- 
taposition of any letter of the cipher component against Aq, then purely 
methods of attack would be too laborious for a practical solution; 
machine techniques could here be used to good advantage. However, there 
Is still the possibility of getting too many acceptable "good answers”, 
from which the cryptemalyst would have to determine the correct answer. 
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c. We bave seen hew easily the strip device treated In par. 76 
suecuSbs to eryptaoalytle attack because of the major weaknesses of this 
system. The same firm that marketed the teansposlteur later produced a 
modified cipher device called the "Sphinx"; this latter device also had 
10 compound strips, but the 20 half -strips were not limited to an upper 
or lover position as was the case of the transposlteur . thus the number 
of possible arrangements Is 20! or 2.4x103-8 instead the 1.33Cl033 in 
the ccuae of the transposlteur. In the SpUnx device there is no con- 
sonant-to-consonant and vowel-to-vowel llndtation as there is in the 
transposlteur. so it lo<^ as if the Sphinx Is a decided Improvement over 
Its predecessor; however. In order to make the system easy to use by a 
cipher clerk, some of the strips are direct standard, others are reversed 
standard sequences. Therefore for each of the 10 columns we will have 
Vlgen^re encli^rment with either direct or reversed standard alidiabets, 
depending upon the identity of the strips used In the particular positions 
—what an "improvement"! 

d. The security of the traneposlteaf could have been enhanced con- 

siderably by the incorporation of 20 random half -strips, not limited to 
upper or lower position, and by not having fixed plaintext and ciphertext 
reading positions. This variable -generatrix idea is incorporated in the 
Jefferson principle exemplified by the now obsolete U.S. Army cipher 
devlee and in strip systems related to this device. The solution 

of these latter systems will be treated in Military Cryptanalytlcs . Part III. 

e. In the solution of the transposlteur. as well as in the 2EN-40, 
we have seen further Instances of the general apiaicablUty of the genera- 
trix method. It is quite surprising hov many times solutions to cryptana- 
lytlc problems depend upon or are aided by the generatrix method, with or 
without minor modifications; the student would do well to keep this always 
in mind, and try to adapt tUs method wherever the opportunity presents 
Itself. 

f. The reason for emphasizing the large numbers In pars. 7? end T6 
is to~demonstrate forcibly that numbers of coMblnations, permutations, or 
keys by themselves often have no bearing upon the cryptanalytlc complezlty 
of solution of a system. If same would-be Inventors of cryptographic sys- 
tems would only stop and consider that the number of possible 26-letter 
simple substitution eLLphabets is 26! or 4-.03xl0^, and that nevertheless 
simple substitution ciphers are solved quite readily, they should be more 
circumspect In bandying about their astronomical numbers too glibly. 

In passing. It is worth mentioning that, no matter how complex a 
system Is as regaxds the generation or use of a large number of alptobets, 
if we have a sufficient number of messages in depth (say 2^-30, for 
English), we will be able to solve the plain texts of the messages, even 
if the cryptographic features of the system remain an enigma. 



l^See subpar. 6c , Appendix 6, 
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CHAPTER XI 

FQLXALPHABEnC BIPARTITE SYSTEMS 



Paragraph 

General 

Analysis of a simple case: the "Nihilist" cipher. B1 

Analysis of a mote complicated example 82 

Analysis of syllabary square systems with superencipherment. 83 
Additional remarks. 84 

80« General. — a. All the aystems thus tar treated have been charac- 
terised by polyalphabietle enciphement of single plaintext letters. In- 
stead of single plaintext letters, the "plain text" to be subjected to 
polyalphabetlc enclphennent might be multiliteral elements of a first 
substitution, such as the left- and right-hand components of a bipartite 
substitution. This "plain text" may be considered either as a secondaxy 
or Intermediate plain text, or as a primary encliAierment; hereinafter ve 
vlU use the expression "Intermediate plain text" to describe this situa- 
tion. 



b. Periodic bipartite aystems may take one of the following three 
prlnclpcd. forms: 

(1) In the simplest form, a suceession of N unrelated bipartite 
matrices la used cyclically to encipher the successive letters of a plain- 
text message. 

(2) A single bipartite matrix with a fixed Internal composition Is 
used, the coordinates of which are slid in a manner giving rise to poly- 
alphabetic substitution. For Instance, if the row coordinates of a 
matrix consisted of the digits l-$ and the column coordinates consisted 
of the digits 6-0, the successive letters of the plain text might be 
enciphered with a cyclical shift of either the row or the column coordi- 
nates, or both. 

(3) A single bipartite matrix with fixed Internal conq>ositlon and 
fixed coordinates is used, with an additive superimposed on the primary 
encipherment to yield a polyal^xabetic substitution. The addition of the 
key might Involve either carrying addition, or noncarrying (i.e., mod lO) 
addition. 

c. The following remarks are generalisations of the cryptanalytlc 
attack on the foregoing systems: 

(l) In the case under subpar. b(l), it Is obvious that solution 
must be predicated on the recovery of the N different matrices Involved. 



24 ? 



REF ID : A64554 



C0HF1DE HT 1AI 7 



If there is no latent relaticmship among the various matrices^ exploitation 
of such a system cannot be aided by any method of equating or correlating 
cipher values belonging to different matrices. 

(2) In the case under subpar. b(2), an entering vedge mi^t be forced 
into the system under the supposition that the matrices were unrelated; but 
if the frequency distributions for the rov and column coordinates are close- 
ly examined; the phenomena associated vltii the use of sliding coordinates 
vould soon manifest themselves and give an indication as to the true nature 
of the system under study, and thus could simplify the problem greatly. 

(3) The third case, that under subpar. b(3) , is the more general case 
of polyalphabetlc bipartite systems. The tecfajulques of solution are suf- 
ficiently detailed and specialized to varrant thorough treatment; this vlU 
be done in the paragraphs that follow. 

8 l. Analysis of a simple ease; the "Mihilist" cipher.- - a. Bie first 
system ve shall treat is that known in cryptologic literature as the 
*irihlllBt" cipher,^ so named because it was first used by anti-Tsarlst 
factions in Russia in the latter part of the 19 th century; the basic idea 
is BO simple that it has been "invented** many times since. This system 
embraces a dlnome substitution followed by a cyclic numerical key as an 
additive. The dlnome substitution is accomplished by means of a bi- 
partite square in ^leh a normal alphabet (I^J) is inscribed, the coordi- 
nates of which are the digits 1 to 3 In normal order; the plain text under- 
goes a primary enclphenoent, and to this encipherment is added (by carrying 
addition) a cyclic numerical key obtained by the encipherment of a key 
word with the basic matrix. Thus we have a polyalphabetlc dlnome encipher- 
ment with a period equal to the length of the key word. 

b. An example of encipherment is given to illustrate this system, 
nie basic matrix is that shown in Fig. 90 ; let the key word be WHTIS, trcm 
lAlch is derived the numerical key 32 23 2k 44 1^, and let the message be 
as follows: RESISTANCE QiCOUNTERED NORTH OF VmJHJB. 



1 

2 

3 

4 

5 



Figure 90 • 



12343 

ABODE 
F 0 H I K 
L H N 0 F 
Q R S T U 
V W X Y 2 



^ Tim IS one of die several types of cipher systems known oy the same name, this appellauon has also 
been given to a kind of false double transposition, as well as to simple bipamte encipliermcnt with die 
matrix in Fig. 90, widiout further cornplexmes. Hus last system 1 $ still encountered occasionally in 
prisons for "grapevine" comm.inications of die Inmates. 
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The plain text is written on a width of five (l*e., equal to the length of 
the key word) , and the prlnazy bipartite encipherment accompllahed as shown 
in Fig. 91 a. The dlnomss of the key are added to the dlnomes of the prima- 
ry enclphexinent, as shown in Fig. 91b. Note the four values in the fifth 
column in Fig. 91b in which the earring addition gives a different result 
from that of the CTistomBry cryptograi^ic noncarrying (or mod 10) addition. 

Key word: 



P: 



w 


H 


1 


T 


E 


W 


H 


I T E 












Additive: 52 23 24 44 15 


r" 


E 


T 


T 


~S 


R 


E 


SIS 


42 


15 


43 


24 


43 


42 


15 


43 24 43 












Cp: 94 


39 


67 68 58 


T 


A 


N 


C 


E 


T 


A 


N C E 


44 


11 


33 


13 


15 


44 


11 


33 13 15 












96 


34 


57 57 30 


E 


N 


c 


0 


U 


E 


N 


C 0 u 


15 


33 


13 


34 


45 


15 


33 


13 34 45 












67 


56 


37 79 60 


N 


T 


E 


R 


E 


N 


T 


ERE 


33 


44 


15 


42 


15 


33 


44 


15 42 15 












95 


67 


39 86 30 


D 


N 


0 


R 


T 


D 


N 


0 R T 


l4 


33 


34 


42 


44 


l4 


33 


34 42 44 












66 


56 


58 86 59 


H 


0 


F 


V 


I 


H 


0 


F V I 


23 


34 


21 


51 


24 


23 


34 


21 51 24 












75 


57 


45 95 39 


L 


L 


A 


G 


E 


L 


L 


AGE 


31 


31 


11 


22 


15 


31 


31 


U 22 15 












93 


54 


35 66 30 



Figure 9^* 



Figure 91b. 



nie final cliAier text, if transmitted in dinome groupings, would be as 
follows : 



94 39 67 68 59 96 34 57 57 30 67 56 37 79 60 85 67 39 96 30 
66 56 59 86 59 75 57 45 95 39 93 54 35 66 30 



Since the enciphering equation is F K ■ C, the deciphering equation is 
F ■ C - K; thus in decipherment the key dinome must be subtracted (with 
borrowing subtraction) trom the cipher text to yield the plaintext dinome. 

e. It will be observed that the lowest possible cipher value is 22 
(arising from Ap + Ait) i And that the highest clidier value is 110 (arising 
from 2p « Zy^) . But in Nihilist encliAienDent the trlnomes from 100 to 110 
(excluding the impossible lOl) are customarily treated as dlnomes by drop- 
ping the first digit; no ambiguity is present because the lowest bona fide 
dinome is 22, thus an initial "0" or ”1" at once Indicates the special 
situation Involved. The student sho'Jld note that in the Nihilist system 
there are certain cipher dlnomes which arise from a unique coniblnatlon of 
plain * key; these are: 
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(1) 22 « Ap ♦ Aij (• n 4- n) only, 

(2) 30 - Ep ♦ Bfc (- 15 ♦ 15) only, 

(3) 02 ■ Vp ♦ Vjt (- 51 ♦ 51) only, and 

(4) 10 ■ Zp + Zfc (. 55 + 55) only. 

The first tvo dlnomes, 22 and 30, can oceur quite frequently, but the other 
two have a nuch smaller probability of occurrence.^ A further observation 
In the Nihilist system Is that if the units digit of a cipher dlnome is 0, 
it could have arisen only from a plaintext 5 enciphered by a key of 5; and 
If either the units or the tens digit of a cipher dlnome Is 2, it could 
have arisen only from a plaintext 1 enciphered by a key of 1. These points 
are very helpful In analysis, as vlU subsequently be seen. 



d. The classic Nihilist system may be recognised by the virtual 
absence of the digit ”1"; this digit cannot oceur at all In the units 
position of dlnomes, and In the tens position It can occur only In the 
very rare case where Zp Is encliAiered by Z|^, resulting In the dlnome 10. 
The usual prlncipleB or factoring apply of co\arse to a Nihilist cipher; 
the period will be a fMtor of the Interval between two occurrences of a 
long repetition, and the 4 test may be used to confirm a tentative period. 
But In the Nihilist cipher, advantage may be taken of its cryptographic 
Idiosyncracles to permit factoring a cryptogram much more quickly than 
would be possible with the usual procedures, and to enable factoring a 
much shorter message than would otherwise be possible with the usual pro- 
cedures for the determination of the period. The specific location In a 
cxyptogram of cipher dlnomes 22 , 30 , 02, and 10 may furnish clues not only 
as to possible periods, but also as to Impossible periods. For Instance, 
If a pair of 22 's is found 24 dlnomes apart, the period may be taken to be 
one of the factors of 24 (unless of course there Is more than one £ In the 
key word) ; conversely. If a 22 Is foimd at a distance of 45 dlnomes from 

a 30, the period cannot possibly be 5 or 9, since a 22 Is predicated upon 
a key of 11 and a 30 is contingent upon a key of 15, and thus there would 
be a clash of key values If the cipher were written out on a width of 
either 5 or 9. 

e. Once a Nihilist clidier la recognized as such, the easiest line 
of attack Is by capitalizing on the cryptographic weaknesses of the sys- 
tem. These points are enumerated below: 

(l) The distance between two IdentlceJ. dlnomes of the (22, 30, 02, 
lO) class will be a multiple of the period, unless there are repeated 
letters In the key word. 



Since the key In the Nihilist system is derived from plain text, the probability if a 30 occurring is 
the square of tlie probability of Ep in English, i.e , (. 1300)^ or 0169, tlie probability of a ‘I'l is . 0054, 
the probability of an 02 is . 0002, and tlie probability of a 10 is only . 000001. 
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(2) The interval between two different dlnomes of the (22 , 30 , 02, 
10) class cannot be a multiple of the period, since the keys involved 
must be different. 

(3) The maxlimim difference between the units digits of dincmes 
enciphered by the same key Is 4. Since the maximum plaintext difference 
Is k (l.e., ^-l), the addition of a key digit from 1 to ^ will not alter 
this characteristic In the cipher text. For Instance, In the key of 
C(13); Ep(l3) becomes 28, and Fp(2l) becomes 3^; the difference between 
the cipher dlnomes (treating the units and the tens positions separately) 
Is l4, which Is the same as the difference between plaintext 1$ and 21. 

(U) The maximum difference between the tens digits of dlnomes en- 
ciphered by the same key Is also 4, If allowance Is made for situations 
wherein the units digit is a 0, in which cue, for example, a cipher 
dlnome 40 must be treated as (3A0) for the tens and units positions, 
respectively. For Instance, In the key of B(l^), Ep(l5) becomes 30 > 

Fp(2l) becomes 36; cipher 30 imut however be treated as (2,10) In the 
tens and units positions, so that the difference between (2,10) and 36 
Is l4, which Is the same as the difference between plaintext 13 and 21. 

(3) From Items (3) and (4), It therefore follows that if the dif- 
ference between two cipher dlnomes is 3 or more In either the units or the 
tens position, the dlnomes cannot possibly belong to the sane cipher al- 
phabet. It also follows that If a difference of 3 or more Is found In 
either the units or the tens position, this rules out a Nihilist cipher 
with a single dlnome as key, l.e., a monoalphabetlcally enciphered dlnome 
system. 

(6) In Fig. 92. below, is given a table of possible key digits de- 
rivable from the range of low-high cipher digits In the Nihilist system. 

As an illustration of its use, let us say that In a particular column of 
a factored Nihilist message the lowest tens (or units) digit is a 3« the 
highest a 9; from the table, it Is seen that the only key digit possible 
is 4. If on the other hand the lowest tens (or uzilts) digit were a 4, 
the highest a 7, It Is seen that the key Is not unique, but must be either 

a 2 or a 3* 
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CONFIDEIfTlAir 



-p 

‘A 

id 



o 

■p 



2 

3 

k 

5 

6 
7 
6 
9 



Highest cipher digit 
45678 



1 


1 


1 


1 


1 












1.2 


1.2 


1.2 


1.2 


2 












1.2.3 


1.2.3 


1.2.3 


2.3 


3 












1,2 

3.4 


1.2 

3.4 


2.3.4 


3.4 


4 












1.2.3 

4.5 


2.3 

4.5 


3.4.5 


4.5 


5 












2.3 

4.5 


3.4.5 


4.5 


5 














3.4.5 


4.5 


5 
















4.5 


5 


















5 



Figure 92* 

(7) Once several hey digits have been established, either uniquely 
or with variants, it is possible to recover the entire literal key by 
anagranmlng among the choices of key possibilities. Sven if the numeri- 
cal key is not derived from a nihilist enciidierment of a plaintext word, 
the unique key values established can be used to deciiOier the particular 
columns pertaining to this key, and a selection from among the other 
multiple keys can be made on the basis of veights of trial plaintext 
decipherments; the weights used may be either monographic or dlgraphic 
weights. 

f. It is time to try out theory in practice. Let us assume the 
eneny~has been using the Nihilist system with periods up to 20, and that 
we have at hand the following cryptogram: 

57 59 55 49 66 66 84 26 74 48 98 59 25 48 26 30 48 77 55 45 

76 57 99 30 56 30 27 48 67 86 86 34 65 45 78 39 45 46 28 39 

55 67 86 32 55 75 70 59 66 49 27 26 76 67 54 22 56 39 97 

nie cipher text is scanned, and it ''s noted that a 30 is fotind as ‘.he 

16th, 24th, and 26th dinomes, and that there is a 22 in the 56th dlnome. 
From the first 30 to the 22 is an Interval of 40; from the second 30 to 
the 22 is an Interval of 32; and from the third 30 to the 22 is an inter- 
val of 30. From this we determine that the period of the cryptogram 
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cannot be any of the factors of 4o^ 32, or 30 > so this rules out 2, 3, 

4, 8, 10, 13, l6, and 20 as possible periods. !Die Intervals between 

the three 30 's are 2, 8, and 10— but since these possible periods have 
been eliminated no encovtragement Is obtained from these Intervals, 
fraught as they are vlth naught. 

(1) Rather than write out the cipher text In various viuths, we 
will try to reject trial periods on the basis of differences of 3 or 
more In the tens or units digits, using a shortcut procedure. Assuming 
first a period of 6, we examine the first and seventh dlnomes, the 2d and 
8th dlnomes, etc., until we come to the 7th and 13th positions where the 
dlnomes 84 and 23 have a difference of 6 In the tens digits, caiislng us 
to reject the hypothesis of a period of 6. A period of 7 Is assmned, and 
this too Is quickly rejected from the 2d and 9th positions where the dl- 
nomes 39 and 74 have a difference of 3 In the units digits. 9 Is rejected 
as a period trim the 7th and l£th positions, where the dlnomes 84 and 30 
have a difference of 3 In the tens digits, and a period of 11 Is rejected 
trim the 3th and l6th posltioxis, where the dinome 66 could not have been 
homogeneous with 30 , since we know 30 must come from a key of 13 (see 
subpar. above). When we try a period of 12, no inconsistencies de- 
velop, so we assume that this Is the correct period. 

(2) The cryptogram is written out on a width of 12, and the four 
columns containing the unique dlnomes 30 and 22 are dediAxered at once, 
as is shown In Fig. 93, below: 





11 












U 










57 


l9 


55 


^9 


66 


65 


W 


25" 




"W 


"W 


59 




44 




34 








15 








44 




T 




0 








E 








T 


23 


46 


26 


30 


48 


77 


55 


43 


76 


57 


99 


30 




33 




15 








34 








15 




N 




E 








0 








E 


56 


30 


27 


48 


67 


86 


86 


34 


VO 


45 


78 


39 




15 




33 








23 








24 




E 




N 








H 








I 


43 


46 


28 


39 


55 


67 


86 


32 


55 


75 


70 


59 




31 




24 








21 








44 




L 




1 








F 








T 


66 


49 


27 


26 


76 


67 


54 


22 


56 


39 


97 






34 




11 








11 











0 A A 

Figure 93. 

The key for the tenth column can be detex*mlned uniquely, since the range 
of the low-high digits (3-7) In the tens position Indicates a key of 2, 
and the range (3-9) In the units position Indicates a key of 4. Further- 
more, the presence of the digit 2 In the tens positions of the first and 
third columns fixes the key as 1 In these positions, and the presence of 
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the digit ^ in the units position of the Uth colunn fixes the key in 
this position as The keys for the rest of the positions are not 
unique; by referring to the table of Fig. 92, the keys (vlth multiiE^e 
values included) are found to be as foUora: 



33 1 21 

23 Ml- 32 32 



(3) Since there are only three key possibilities (12, 13, or l4) 
for the first column, ve vlU make trial decipherments and score these 
dscl^zvents with the declban velg^ta vlth lAlch the student is now 
familiar (cf. subpara. 34c and f). This information is shown in the 
diagram below: ~ 



Trial key 
of 12 



Trial key 
of 13 



Trial key 
of 14 



Wgt. 


Wgt. 


Wgt. 


45 


44 


43 


U 6 


T 9 


S 8 


13 


12 


11 


C 7 


B 4 


A 8 


44 


43 


42 


T 9 


8 6 


R 8 


33 


32 


31 


N 6 


M 6 


L 7 


54 


53 


52 



Scores: 36 || 30 II 36 I 

With such scanty data of only five letters available per column, the 
declban scores are not Inmedlately conclusive; apparently the keys of 12 
and l4 are equally good, vlth the key of 13 a third choice. However, since 
the second column of Fig. 93 has been deciphered, a much more sensitive 
discrimination among the three key possibilities for the first column may 
be obtained by the use of difgaphic weights. The three sets of digraphs 
formed by the three possible decipherments of column 1 taken vith the 
decii^rment of column 2 are shown in the diagram below, together with 
the eentiban weights of the digraphs (cf. Table 1^ on p. 265 of Military 



Scores : 



Case I II 


UT 


58 


CN 


13 


TB 


91 


NL 


42 


10 
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Case II Case III 

TT 67 ST 08 

BN 00 AN 69 

SE 64 RE 96 

ML 00 LL 73 
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It l8 clear from the high score of 413 that Case 111 has the best statis- 
tical probability^ of being the correct case; thus the key for t^ie first 
column Is l4. This process could be continued vlth other columns where 
necessary, until sufficiently long plaintext polygraphs are deciphered to 
pemlt finishing the solution by contextual analysis. The message is 
found to begin with the words SlStONG BESISXANCE, and the key is now derived 
uniquely. 

(4) The foregoing approach la a general approach, independent of the 
constitution of the additive key. Where the latter has been derived from 
the bipartite encipherment with the Nihilist square of a plaintext word, 
euxother approach la via the anagramnlng of the key word from the multiple 
possibilities; this Is especially easy when the data are sufficient to 
reduce the number of multiple values. In the case Just studied the key 
recovered In subpar. 8lf(2) is given below, together vlth the multiple key- 
letter values involved:" 

2 

2 33 1 21 

3 3 23 44 32 32 4 

14 15 14 15 34 55 43 11 43 24 55 15 

BECEHMLAFIUE 
C D I N M G Z 
D NONE 

0 P Q L 

R R H 

S S N 

T Q 

U R 

W S 

X 
Y 
Z 

A few moments' inspection of the beginning and ending portions establishes 
that the key word la DECENTRALIZE. 

We have seen how simple it is to solve a Nihilist cipher if the 
square is known. If the square had the row and column coordinates in an 
unknown XMnmitatlon of the digits 1>5> or if the Internal composition of 
the square consisted of an unknown mixed sequence, solution is hardly more 
dlfflex;G.t, as will now be demonstrated. 



^ Case III IS better than Case I by a factor of 224^ - 4163, that is, Uie difference between 413 and 259, 

treated as an exponent of tlie base (224) of the logarithmic weights. 
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(l) Let us consider the following Nihilist cryptogram enclidiered with 
a modified square: 

87 53 7 *^ 67 49 48 66 55 66 87 42 65 57 58 76 45 66 75 75 74 

67 75 58 48 44 62 86 75 35 65 64 36 46 56 56 66 87 36 96 68 

58 48 46 85 59 97 55 85 68 78 87 36 62 87 97 54 96 84 47 48 

44 56 66 87 52 06 65 38 49 66 55 67 98 55 96 68 66 55 46 84 

67 07 45 96 85 68 67 44 84 65 86 54 07 86 56 87 24 62 67 99 

53 95 87 50 77 56 74 59 68 73 96 68 

Ihere are no occurrences of the xinlque dlntnnes 22 , 30, 02 , or 55 ; Qor are 
there any readily discernible long polygraphic repetitions; nevertheless 
factoring Is very easy by the process of inspection outlined in subpar. 
f(l), above. All periods between 1 and 20 are eliminated except 9 and I8, 
so It Is assumed that 9 la the correct period and the cryptogram Is written 
out as is shown below: 



123456789 
87 53 7 ^ 67 49 4 s 66 55 66 

87 42 65 57 58 76 45 66 75 

75 74 67 75 58 48 44 62 86 

75 35 65 64 36 46 56 56 66 

87 36 96 68 58 48 46 85 59 

97 55 85 68 78 87 36 62 87 

97 54 96 84 47 48 44 56 66 

87 52 06 65 38 49 65 55 67 

98 55 96 63 66 55 46 84 67 

07 45 96 85 68 67 44 84 65 

86 54 07 86 56 87 24 62 67 

99 53 95 87 50 77 56 74 59 

68 73 96 68 

(2) Referring to the table of Fig. 92, it may be seen that the keys 
for the columns must be as follows: 

cols.: 123456789 

keys: 54 21 ^ 33 25 34 11 31 34 
53 43 12 4 l 44 

13 

Since the keys for cols. 1 , 2 , 5 ; and 6 are imlque, these keys are sub- 
tracted from the corresponding cipher dlnomes to yield a conversion to 
monoalphabetlc terms. 3 hls conversion is shown below: 
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cols. : 
keys: 



1 


2 3 


4 5 


6789 




21 




34 


33 


32 


24 


i4 


33 


21 


33 


42 


21 


53 


33 


14 


21 


14 


11 


12 


33 


15 


33 


l4 


k3 


34 


53 


53 


^^3 


33 


22 


14 


33 


31 


13 


15 




34 


4l 


21 


53 


24 


43 


33 


32 


33 


31 


53 


45 


32 


25 


43 


l4 


52 







Tbe distributions for tbese columns are given belov: 

col. 1: a — _ 

11 12 13 U ^ 21 22 23 M 25 ^ 32 M 3-3 41 42 ^ ^ 45 51 ^ 53 54 55 

col. 2: 
col. 5; 

IT 12 l3 14 15 21 ^ 23 24 25 » 32 ^ 34 35 4l ^ ^ 44 45 51 52 y 54 55 
col. 6; ~ 



The 4 counts for col. 1 (16) and col. 6 (l4) are excellent, but those for 
col. 2 (6) and col. ^ (6) are verj' poor. Nevertheless, the x. test per- 
formed tetveen the distributlous for cols. 1 and 2, and between cols. 1 
and 5, give excellent results, thereby Indicating that they belong to- 
gether. The combined distribution of cols. 1, 2, 5^ 6 Is as follows: 



11 12 13 S 15 *1 22 23 24 25 



^ ^ M 35 



41 42 43 44 43 51 52 Is 



N = 50 



54 35 



The I.C. 



of this distribution** Is 



25ff(f - 1) 

50 X 49 



1.62, which Is excellent. 



(3) The key for col. 3 is either 52 or 53; vhat we will do now Is 
make trial decipherments of col. 3 vlth both of these keys, and we will 
compare tbese decipherments with the coniblned distribution of cols. 1, 2, 
5, and 6 to find the best match. This is shown below: 





In tins case, we must rememner that a 25-element alphabet is involved and modify the formula for die 
accordingly. 
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col 3; 
(k=52) 



i - 3 _ f6 = S # 

11 12 13 14 15 21 22 23 24 25 31 32 33 34 35 41 42 43 44 45 51 52 53 54 55 



Tl 12 13 14 Is 21 22 23 ^ 25 ?1 32 Is M 35 41 42 43 44 45 51 52 ^ 54 55 



col. 3: 
(k-=53) 



The key of ^ gives a 7 ^ value of 2k, and the key of 53 gives a value of 
4l; this shows that the key for cc^. 3 should be 

(4) The entire tabulation of trial keys for the five nonunique colunms 
are given below, together with the X valuss as compared with the combined 
distribution of cols* 1, 2, 5> euid 



11 12 13 14 15 21 22 23 24 25 31 32 33 34 35 41 42 43 44 45 51 52 53 54 55 




From the foregoing, it is evident that the keys for the nine columns are as 
follows: 



123456789 
54 21 53 43 25 3^ 13 'H 3'^ 

( 5 ) All nine columns of the cryptogram may now be converted into 
monoalptobetic terms, as follows: 
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33 


32 


21 






iT 


53 


nr 


32 


33 


21 


12 


14 


33 


42 


32 


25 


4l 


21 


53 


14 


32 


33 


14 


31 


21 


52 


21 


14 


12 


21 


U 


12 


43 


15 


32 


33 


15 


43 


25 


33 


14 


33 


44 


25 


43 


34 


32 


25 


53 


53 


23 


21 


53 


43 


33 


43 


4l 


22 


14 


31 


15 


32 


33 


31 


53 


25 


13 


15 


53 


14 


33 


44 


34 


43 


25 


4l 


21 


33 


43 


33 


53 


24 


43 


42 


43 


33 


31 


43 


31 


32 


33 


54 


43 


31 


53 


11 


21 


33 


45 


32 


42 


44 


25 


43 


43 


33 


25 


14 


52 


43 


25 













The slmiile dlnome eubstltutlon is readily solvable, and the plain text 
Is found to begin vlth the words KO ADDITIONAL. T!te square as recovered 
Is shovn In Fig. 94a; upon observing the phenomena characteristic of a 



1 2 3 t 5 ,3 a » 5 1 



1 


B L U 1 G 


2 


HYDRA 


2 


A y H D R 


1 


U L I C B 


3 


S 0 N P 


4 


E F G K M 


4 


M F S G K 


3 


N 0 P Q S 


5 


V T W 


5 


T V W X Z 



Figure 94a. Figure 94b . 




keyword-mixed sequence Inside the square, the rows and columns of the 
reconstruction squats are permuted to yield the original eneli^erlng 
square as shown In Fig. 94b. The additive key, when deciphered through 
the reconstrueted square, is found to be based on WATER FUMP. 

8g. Analysis of a taoee complicated example.— a. In the next ease 
to be considered. It will be assumed that the enemy Is known to be using 
various types of dlnome matrices In conjunction with an additive super - 
encipherment, the arithmetic being performed mod 10. The foUcwlng mes- 
sage baa been Intercepted: 



91 


67 


92 


80 


74 


71 


05 


60 


80 


36 


99 


87 


80 


10 


49 


64 


39 


92 


73 


64 


53 


88 


26 


46 


61 


67 


17 


52 


37 


91 


57 


iL 


88 




iS. 


li 


75 


21 


02 


61 


76 


35 


39 


58 


58 


72 


96 


86 


58 


47 


21 


77 


00 


99 


79 


50 


65 


21 


72 


16 


56 


47 


20 


61 


16 


26 


60 


59 


29 


00 


90 


57 


08 


43 


60 


24 


42 


00 


72 


76 


73 


37 


79 


78 


44 


31 


17 


91 


04 


07 


06 


70 


17 


13 


19 


31 


65 


38 


33 


31 


63 


88 


90 


10 


94 


63 


82 


29 


72 


62 


03 


66 


38 


4o 


00 


56 


75 


87 


83 


76 


95 


02 


52 


48 


87 


03 


05 


03 


60 


16 


28 


79 


68 


04 


07 


92 


72 


86 


30 


00 


98 


35 


58 


13 


67 


26 


05 


52 


78 


67 


63 


70 


48 


77 


16 


23 




88 


4^ 






72 


22 


34 


31 


99 


44 


37 


80 


48 


51 


77 


91 


03 


30 


64 


5o 


"W 


sT 


25^ 




85 


83 


73 


02 


64 


15 


86 


30 


41 
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Tbfi polygraphic repetition present at an intenral of 125 dlnomes suggests 
that the basic period Is five dlnomes (i.e., a 10-dlglt additive sequence). 
Since the aessage above Is already written on a width of 20 dlnones, it will 
be convenient to make a distribution of the 10 colunns, as follows: 



Col. 1: 


12345?7890 


Col. 2 : 


i-plaai.... 

1234567890 


% 


Col. 3: 


^ as.iM-a 

1234567890 


Col. 4 : 


pi .|l.|tt.a 

1234567890 


9 


Col. 5: 


1234567S90 


Col. 6 : 


lf 34567 ? 9 ? 




Col. 7: 


a- jtflB»2a_a 

1235^567890 


Col. 6 : 


1234567890 


w 


Col. 9: 


^ - ! ■ - ■ pi 

123^567890 

Figure 95a. 


Col. 10 : 


f 2345 ?f 890 

Figure 95 b. 


T 



b. It will be observed that the foregoing distributions may be classed 
into ^o families, one comprising the odd columns and the other comprising 
the even columns;^ the reason for this Is that the frequencies of the row 
coordinates of the underlying matrix have a distinct pattern of peaks and 
troufipu, and likewise the frequencies of the column coordinates have a dis- 
tinct pattern, different from that of the row coordinates. The addition, 
mod 10, of a key digit merely displaces the entire pattern of peaks and 
troughs. Just as in a standard alphabet cipher a change of key letter dis- 
places the distribution by the value of the key letter (nod 26) Therefore 



° Note that thu is further proof tfiat tlie underlying text is In dmomes. If die intermediate plain text had 
consisted of tnnomes, or monomes and dmomes, the columnar distributions would not have fallen into two 
families, instead there would have been only one family discernible, and solution would progress by marcliii)g 
all the distribuuons together, without regard to their parity. See in this connection subpar SSg. 

^ Mod 10 addition is really a digital version of a Vigenue uble with standard alphabets, as will be seen 
from the following diagram: 

Plaintext digit 

0 12345676 9 



Key digit 



0123 ^ 5^789 

1234567890 

2345678901 

3456789012 

4567890123 

5678901234 

6789012345 

7890123456 

8901234567 

9012345678 



Cipher 
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the distributions within each of the families may be slid to find, the 
best natch, and. we have the following: 



Col. 1 : 123^367890 Col. 2 : 123^367690 

BB.iM.Bjl 

Col. 3 * 23^^3678901 



Li— ^ - 

Col. ks ^67690123^ 



.^a.ij^B.pB Bai|ljiBi« 

Col. 3: ^367890123 Col. 6 ; 67090123^3 



Col. 7: 



Col. 9: 



. B B _ pfe i B « |i B 

90123^3678 

-Sb Bi|l-8 {l 

5678901235^ 

Figure 96a. 



Col. 



i.iaBSa 

8 : 8901235367 



Baii.a^i . 

Col. 10 : 5567890123 

Figure 96b. 



e. The relative displacements of the odd columns, In terms of col. 
1, are 0, 1, 3 « 8, and 5 ; the relative displacements of the even columns, 
in terns of cOl. 2 , are 0 , 5 , 5 , 7 » &od 3 > Therefore if we arbitrarily 
treat the additive for the first dinome as 00, the second dlnome has a 
relative key of l 5 , the third dlnome a relative key of 33 j the fourth a 
key of 87, and the fifth a key of 53 ." The key digits an subtracted 
from the cipher, to yield a reduction in terms of the first of the five 
dlnome columns. This Is Illustrated in the work sheet below: 



7 



Thu relative additive differs from the true additive by a dinome constant. 
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Additive: 00 35 8? 43 00 l4 35 87 43 00 1^ 35 87 43 00 l4 35 87 

Ciphertext: 91 6? 92 8o 71 05 60 flo 3b 99 &7 So 10 49 S^^ 39 ^ 73 64 

•Plain text ’•: 91 53 6? 03 31 71 91 35 03 93 99 73 55 33 06 64 25 67 96 21 



53 


88 


26 


46 


61 


67 


17 


52 


37 


91 


57 


17 


88 


50 


95 


15 


75 


21 


02 


61 


53 


74 


91 


69 


28 


67 


03 


27 


50 


58 


57 


21 


J1 


J1 


JL 


Jtl 


61 


96 


25 


28 


76 


35 


39 


58 


58 


72 


96 


66 


58 


47 


21 


77 


00 


99 


79 


50 


65 


21 


72 


16 


76 


21 


14 


71 


15 


72 


82 


51 


71 


04 


21 


63 


75 


12 


36 


50 


51 


96 


95 


73 


56 


47 


20 


61 


16 


26 


60 


59 


29 


00 


90 


57 


08 


43 


60 


24 


42 


00 


72 


76 


56 


33 


95 


84 


73 


26 


56 


24 


42 


67 


90 


43 


73 


66 


27 


24 


38 


75 


95 


33 


73 


37 


79 


78 


44 


31 


17 


91 


04 


07 


06 


70 


17 


13 


19 


31 


65 


38 


33 


31 


73 


23 


4 o 


91 


01 


31 


03 


66 


27 


64 


06 


66 


82 


36 


76 


31 


51 


03 


56 


98 


63 


88 


90 


10 


94 


63 


82 


29 


72 


62 


03 


66 


38 


4 o 


00 


56 


75 


87 


83 


76 


63 


74 


65 


33 


51 


63 


78 


94 


95 


29 


03 


52 


03 


63 


67 


56 


61 


52 


06 


33 


95 


02 


52 


48 


87 


03 


05 


03 


60 


16 


28 


79 


68 


o 4 


07 


92 


72 


86 


30 


00 


95 


98 


27 


61 


44 


03 


91 


78 


83 


73 


28 


65 


33 


27 


64 


92 


68 


51 


53 


67 


98 


35 


58 


13 


67 


26 


05 


52 


78 


67 


63 


70 


48 


77 


16 


23 


17 


88 


50 


95 


98 


21 


23 


36 


24 


26 


91 


27 


91 


24 


63 


66 


13 


90 


73 


23 


21 


il 


J1 




15 


72 


22 


34 


31 


99 


44 


37 


80 


48 


51 


77 


91 


03 


30 


64 


4 o 


69 


4 l 


25 




68 


97 


57 


98 


99 


30 


02 


03 


05 


51 


63 


66 


26 


97 


64 


36 


34 


64 


82 


35 


85 


83 


73 


02 


64 


15 


86 


30 


4 l 






















35 


71 


58 


96 


69 


64 


01 


51 


53 


08 























Figure 97« 



d. A dlnone distribution Is now taken on the pseudo-plain text; this 
is asHfoUovs: 




1 

2 

3 

4 

5 

6 

7 

8 



123456789^ 

1123 

4 3423631 

3 6124 1 1 

111 1 
746 1422 2 

3 6625622 

419222 2 
311 

7111542422 
2 lU 13 1 

30 12 45 IS 18 25 16 15 5 6 

Figure 98 > 
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Matching propensltlea are detected anong the rova of the matrix, but not 
among the eolumna; thia pointa to the poaaibility of a variant matrix of 
10 eolumna and perhapa three rove. Thia aeaumption ia atrengthened by the 
local variation among the dlatributiona for the even eolumna in Fig. 9^ 
(theae varlationa being a direct function of the plain text being en- 
ciphered), and by the pronounced almllarlty of the dlatributiona for the 
odd dlglta in Fig. 95a (the aladlarlty of theae dlatributiona being cauaed 
by a "check-off" procedure in the variant iiaage). 

e« We note in Fig. 98 that rova 1, V, and 8 are homogeneoua and that 
therefore they belong to one family. Rov 6, with 32 talliea, ia the row 
vlth the heavleat dlatribution; therefore we ahall begin by taking the 
croaa-producta aum of row 6 vi^ the remaining alx rova that come into 
conalderatlon (excluding the 1-4-6 family)^. Thia la abovn in the diagram 
below: 



X(6f2): 
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It la clear that there la an outatandlngly good match betveen rov 6 and 
row 2, ao theae rove belong to the aame family. The other % valuea are 
leaa clear, except for the outatandlngly low value of the match 6-3> vhlch 
Indlcatea that 3 Is in a different family. 



f. We now compare rov 3 vith the remaining four rova, and we get the 
foUo^ng: 
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From thia ve aee that row 3 Aod. row 0 undoubtedly belong together, and 
that in probability rov 9 (the loweat ^ value) doea not belong with 
3 thia would imply that rov 9 belonga vith rova 2 and 6, alnee the 

family of 1-4-8 la diatinctlve enou£^ to permit no other additiona. How- 
ever, we ahall leave thia decialon to one more teat. 



The only rows left to place are the 'I, and 9 rova. In order 
to facilitate the matching of theae rova vith the rova of the 2-6 and the 
3-0 famillea, ve will firat amalgamate the menibera of the famillea aa ve 

A ' ’ 

See also pp, 112-113 of Mi litary Cryptanal yt ics, P art I , in connection with the use of the cross-products 
sum in the analysis of a variant system. 
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have them so far so that ve may have more typical distributions for these 
families; this aamlgamatlon is as follows: 



■ ( 1 * 4 ^): 
P ■ (2+6): 

y ■ (3+0) : 



123456789^ 
- 5343 - — -1 
7-9 10 48 12 53 - 
51 17 137-2-1 



We will now take the cross-products sum between the ^ row and rows 5, 7, 
and 9; and likewise between the y row and rows 5, 1, and 9* This yields 
the following: 






■/ 

y( yi5): 

X) 



>7): 



(^9): 



Jf 



1 2 34567890 
49 - 54 - 4 32 24 10 - - 

28 - 8l 20 8 15 - 10 - - 

49 - 9 10 20 32 24 20 6 - 

35 4102 - 3 28 - 4 - 2 
20 1 153 2 6 14 - 4 - - 

35 1 17 1 15 28 - 6 - 2 



- 173 
» 163 
* 170 

■ 178 
> 200 

■ 107 



It is apparent that row 7 belongs to the y femilly, since ;c( f *7) ^ 
high value of 200 whereas the ,l) has the much lower score of l63* 
Furthermore I the lowest score of IO7 for ;);( y ,9} when compared with the 
value of 170 for j9) confirms that row 9 belongs with the family 
rather than with the y family. The family relationship of row 5 is still 
Indeterminate statistically, because the methods we are using do not have 
sufficient diserimixiatory power for us to be able to place row 5 with any 
confidence. Our consolidated frequency distribution (less the tallies of 
row 5) now looks as follows: 
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h. We will now convert the intermediate text of Fig. 97 to true 
monoalphabetlc terms using the consolidated ftreguency matrix Just obtained, 
calling the three rows "1", ”2", and "3". The dinomes beginning with the 
digit 5 we will leave unchanged, since ve do not know the relationship of 
this row. This conversion is shown in Fig. 99, below. 
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Figure 99. 

The dlnone of outstanding frequency, 3I, may be assuned to be Ep; this, 
coupled with the Idlomorphlc pattern of the message beginning, establishes 
that the first word Is INTELLIGENCE and places the " 5 " row In the 2-^-8 
family. The text is easily solved, and a reconstruction matrix obted.ned 
as shown In Pig. 100 a, which may be permuted Into the matrix shown In 
Pig. 100 b. 
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Figure 100 a. 



Figure 100 b. 
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1. A closer azaaixiatloa of the sequence of digits eosiprlslng the 
eoluiiia coordinates reveals that, if ve subtract 7 (nod. lO) traa each of 
these digits, ve vlU have a numerical key based upon the key word 
MQHARCHIST->in other vords, ve are able to reduce the even digits of 
the dlnone additives to their primary instead of relative equivalents. 

It vlll also be discovered that if 5 Is subtracted from the digits com* 
prising the row coordinates, ve will get an assembly of digits that can 
be put into a logical numerical order vhich undoubtedly is the original 
set of row coordinates; or, if the lateral differences (called in crypto- 
logic language the "deltas") between tte dinomes of the relative additive 
key 00 l4 3? 8? ^3 nre examined, the delta sequence l4 21 52 66 is the 
same as the dlnome delta sequence of the numerical key based on MONARCHIST. 
This now proves the original primary enciphering matrix, as veil as the 
original primary additive key. The true additive key is 37 8l 82 3^ 90, 
and the original matrix is that shown in Fig. lOOe, below. 



07JU. 

832 

963 



5761823490 

MONARCHIST 
BDEFGJKLPQ 
U V W X Y Z 1 



Figure 100c. 



We have shown (in subpars. b and c) with this problem only one 
method of equating coliunns of additive -encii^ered dlnome text. In the 
next paragraph there vlll be shown several other methods applicable for 
reducing polyalphabetlcally enciphered dlnome text to slnqple (i.e., mono- 
alphabetic) terms, without regard to the mechanics used to produce the 
dlnome intermediate text. 



83. Analysis of syllabary square systems with superenelpherment. — a. 
A logical extension of the Idea of bipartite systems with encipherment is 
a system vhereln the original plain text is first eaclphered with a syl- 
labary square or a code chart, followed by a superimposed additive upon 
the primary encipherment. In the problem next to be considered, ve will 
assume that the enemy is using the syllabary square illustrated in Fig. 
101, below, in conjunction with a cyclic additive. For this first sltua- 
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Figure 101. 
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tlcm we will assume that the eoardluates are knovn sequences, and that 
they are the digits 1-f^ in noraal order. 



b. The foUcnring exyptogram is available for study: 
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The longer polygraphlc repetltiona present have 
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fsetor of 8; 
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but there are several shorter repetitions which fhctor to k, so it will 
"be assumed that tbs additive is 4 dlnooes. (If we wished to play it 
safe, we could have made distributions on the basis of 8 ctAunns; this 
would have disclosed good matehlz^g between the distributions for the 1st 
and 5th coLuimis, etc., revealing that the period is actually four dlnoase.) 



c. 

foUcm: 



Dlnone distributions are asde for the four dinoae eoluans, as 
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Figure 102a. 
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Figure 102 e. 
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Figure 102 d. 



We vlU nov attempt to eqjuate the first digits (1 and 3 ) of the dlnone 
cdLuans I and U, and also the second digits (2 and 4 ) of cols. I and II. 
This Is shown In Figs. 103 a end b, below: 
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Figure 103a. Figure 103b. 

In Fig. 103^ the matching of the row digits gives three outstandlxig % 
values, bxxt these values are too close together to permit an easy choice 
among them. On the other hand, the matching of the eoluaa digits produces 
one outstanding very hle^ Rvalue, 1088, idiich Indicates that the column 
digits of II have a relative displacement of vl In relation to the column 
digits of I. In order to be able to discriminate among the three likely 
choices for the matching of the row coordinates of I and II, we will per- 
form the ^ test on dlnome distributions; this test with dlnones Is much 
more powerful than matching on the basis of single-digit distributions, 
not only because the latent primary encipherment has strong dlnome charac- 
teristics, but also because of the cohesion of plain language, l.e., given 
a particular plaintext letter, the occurrence of the next letter is not 
based upon a random choice from a ^iase^ population of plaintext fTegpen- 
eies but is governed by the cohesion or affinity of letters forming plain- 
text digraphs. 
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d. Since tbe relatlonehip of the column coordinates of II In 
reference to I has been determined, and since the three hl^iest ^ values 
for the row coordinates of H Indicate slides of 7j 6, and 8 with respect 
to Ij we will rewrite the dlnome distribution for II In three ways to 
permit an easier (and less subject to error 2 ) matching of the dlnoms dis- 
tributions of 1 and II. Ihe three transfoniatlons of the distribution for 
II are shown below: 
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Figure IQlia. 



Figure 104b . 



Figure lOiic . 



The cross-products sum of the dlnome distributions is taken by multiplying 
the entries In each cell of I with the correspon^ig cell of II, and then 
adding up all the cross-products thus derived. (Fw example, cell 1-1 of 

I Is compared with cell 8-2 of II; cell 1-2 of I is compared with cell 8-3 
of II; etc.) The y. test of the dlnome distribution of I against the dlnome 
distributions of Figs. 10^ ^ and e yields % values of 123, 91, and 236, 
respectively; thus It Is Indicated Uat row 9 of II Is eqiuated to row 1 of 
I, or a slide of 47- This now means that If col. I Is arbitrarily con- 
sidered to have the additive 00, this fixes the relative additive for col. 

II as 81. The merged distribution for dlnome columns I and II properly 
equated Is now as follows: 
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Figure 10^. 
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e. The process of equating dlnome coIuDns III and IV with the nsrged 
distribution for I and II continues as befcnre, relying on the slnj^-dlglt 
distributions for obtaining the best two or three choices or so, and then 
determining the correct choice by the %>test analysis of the dlnone dis- 
tributions as was performed in subpar. ^ above. By this process the 
relative additive for the four dlnome columns Is derived as 00 8l 75 39> 
Ihese key digits are now subtracted Ibom the cl]^r text of the cr;^ogram 
given in subpar. ^ reducing the complex text to monoalphabetlc terms; the 
first line of the conversion is therefore as follows: 

Addittve: 00 81 75 39 00 8l 75 39 00 8l 75 39 00 8l 75 39 00 8l 75 39 

Cipheitext: 72 99 ^ 93 76 12 12 £ 66 ^ ^ 28 49 '^3 ^ 00 43 22 2& 99 

-Plain text": 72 l8 67 64 76 31 ^7 52 66 53 67 99 49 62 67 71 43 4l 53 6o 



![he conversion of the entire text to mo n oal p habetlc terms is given in Fig. 
106, below: 
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Figure 106. 
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All ve need nov la a single dlnone as a eorreetlve to convert the entire 
cipher text from, our arbitrary base to the true base vhleh would enable the 
reading of the message directly with the syllabary square shown In Fig. 101. 
As an easy solution, If the cryptogram In Fig. 106 ends with a signature. 

It Is possible that the last element Is an Fp (froai INF); or the sequence 
58 58 In the 4>dlnamB repetition of the 8th line of Fig. 106 nay be tried 
as a doubled Sp, Pp, or Lp. !Die corrective for the additive Is thus found 
to be 93, making the true additive sequence 93 ih 68 22 vhleh vUl decipher 
the beginning of the nessage as SBCCND RBQIMENT. . • • 

f. Note that there are three sets of 9-dlnome repetitions present In 
the optogram given In subpar. b. It la quite possible that two of these 
sets nd^t represent Identical plain text; If this Is so. It will nake 
possible a very easy method of equating tto columns without recourse to 
analysis of distributions. For Instance, let us suppose that the repeated 
sequences (76 12 12 8l 66) and (ill 60 kj 33 31) actually are Identical In 
their underlying plain text, and that the cryptogram has been factored to 
a period of 4. Ihe sequences are aligned under their respective dinoms 
columns thus: 



I n m IV 

(76 12 12 81 
66) (in 60 
47 33 31) 

Then If the additive for cbL. I is taken as 00, It Is clear that. If 4le(lH) 
is to represent 76, the additive for col. Ill must be 75; this shews the 
method how a relative additive can quickly be recovered by exploiting Isologous 
cl]^hertext sequences. (The validity of the additive Is confirmed If latent 
repetitions are now uncovered In other parts of the cipher text.) The student 
should keep this method In mind for possible use In the analysis of other 
types of systems which might lend thoneelves to this attack. 

£. It should be clear to the student that the column-equating methods 
treated In the foregoing subpaaragraphs do not depend upon any known ftietors 
eoneemlng the cooposltlon of the matrix or of the coordinates. One more 
generally applicable method of equating will now be demonstrated; and. In 
order to lUustrate a different case, we will assume that the matrix Is still 
that of Fig. 101, except that the coordinates are unknown mixed sequences. 

The foUowlng message, factoring^ to a period of 6, will be studied: 



9 See In this connection subpar. 8^. 
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4l 30 07 04 63 53 61 21 33 79 39 04 7^ 3^ 51 93 60 29 60 23 89 68 Tk 3^ 
83 51 9419 17 84 66 04 04 33 24 20 42 92 20 23 92 35 11 26 36 92 13 69 



83 51 94 19 17 84 66 04 04 33 24 20 42 92 20 23 92 35 11 26 36 92 13 69 

13 03 99 56. 98 09 42 10 40 99 48 82 95 20 72 75 24 12 42 92 20 23 92 90 

o4 66 60 60 16 71 42 48 72 78 03 17 44 13 33 43 17 87 12 48 o4 o4 91 93 

71 42 72 78 97 37 84 80 26 36 8689 44 26 31 28 24 11 U 80 83 36 08 83 

19 10 91 25 31 37 17 52 23 95 23 55 83 51 94 19 17 84 66 50 11 17 24 11 

^11 34 45 06 4o 69 37 16 36 83 48 35 89 

Figure 107. 

nils message Is too short to permit analysis of the fjreguency distributions 
with confidence; and there are no sets of equal-length repetitions to allofr 
us to equate columns by the method indicated, in subpar. £, above. Neverthe- 
less, the dlnone columns may be equated If ve can discover some latent 
repetitions In the cipher text -which could then be exploited In a manner 
similar to that shown In subpar. f. These latent repetitions may be made 
patent by means of a dlfferenclng~technlque now to be described. 

h. Let us examine the following Isologous encipherments produced with 
the square of Fig. 101 and the additive 74 31 89 60 23 12: 



89 60 25 12 



D I V IS ION HE 

31 54 04 39 58 33 

05 85 83 19 73 63 

A D Q U AR TER 

11 31 70 03 16 96 

83 62 59 63 31 08 

S 

88 

52 

Figure 108a. 



ION BE 



89 60 25 12 



V IS 
31 54 04 59 
10 14 29 61 

A D Q U 



58 53 11 31 70 03 

22 84 90 91 95 15 

AR OER S 

16 96 88 

80 27 67 

Figure 10&. 



Referring to Fig. 108a^ if ve subtract (mod lO) each cipher dlnome from the 
cipher dlnone Just below It (l.e.. In -the corresponding position of the next 
cycle of the period), ve vlU derive the "delta" or difference stream 60 87 
76 54 68 43 77; If ve difference the plaintext dinones the same vay, ve vlU 
get the Identical delta stream. The reason for this Is that the difference 
be-tween two plaintext elements, , Is unchanged If the same constant "k" 
Is added to each of the elements; or, expressed algebraically, (at.+ k} - 
( l^fk) B (w .|3). In other vords, the difference between the cipher elements 
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at an Interval corresponding to the period represents the difference 
between the underlying plaintext elements . thus removing the effect of 
the additive. Once therefore having established the period in a nuzaerl- 
cal system with additive superenclphement. If ve derive a delta stream 
at an Interval corresponding to the period, any latent polygrai^lc repe- 
titions viU be uncovered in this process. The delta streams obtained 
from Figs. 108a and b are shown below: 

I II m IV V VI I II m IV V VI 

80 87 76 5^ 68 U3 8o 87 76 5^ 

77 68 43 77 

Figure 10^. Figure 10^. 

ihe repetitions In the delta stream are of such length that they must be 
Interpreted as having arisen causedly. Just as long cl|diertext repetitions 
in a relatively small saagile of text have to be attributed to the effect 
of identical keys applied to identical plain text, producing identical 
cipher text. The method of exploitation of the delta repetitions trm 
this point on will be discussed In subpar. J,, below. 

1 . The Isologoua passages in Figs . 108a and b were enciphered by 
two fbil cycles of the period. Note the exa^les below, in which the 
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109a. 
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109b. 
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Figure 10^ Figure 109d. 

The delta repetition la four dlncmes In length, ^rtd.ch is one cycle less 
thaw the length of the Isologous plain text; l.e., 10 - 6 *4. Note, how- 
ever, the following examples: 
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UOb. 
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Figure UOc. Figure UOd. 

Here the delta repetition Is fow dlnooes also; this repetition, howerer, 
arises not from a long plaintext repetition, hut trcm Identical sets of a 
4-41nooe repetition In the plain text over another 4-dlnoDe repetition In 
the plain text. This means that. If a delta repetition does not extend to 
a full cycle or more of the period, ve mist not jump to conclusions that a 
short delta repetition Is the result of a single long plaintext repetition; 
In Figs. UOc and ^ the 4-dlnome repetition, as may be seen. Is not the 
result of a ro-dlnone plaintext z'epetltlon. 

J,. Nov to get back to the cryptogram of Fig. 107. Since the cipher 
text factors to 6 dlnomes, ve vUl subtract each dlnome from the one six 
places to the right of It to obtain the delta stream; this Is shewn In 
Fig. Ill, belov: 
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^IVo sets of repetitions are revealed In the delta stream, one of 7 dlnomes 
and one of 4 dlnomes. The longer one must perforce represent a repeated 
plaintext passage beginning 6 dlnomes to the left of the delta repetition, 
but there Is no assurance that the 4-dinome delta repetition represents a 
longer plaintext repetition; in any case, ve shall use only the Informa- 
tion derived from, the lengths of the delta repetitions as disclosed. 

(l) Let us record the original ciphertext sequences irialch stand 
above the 7-^nome delta repetitions of Fig. Ill; allocated into their 
proper positions in the k.ey cycle, these are as foUovs: 

1 n III IV V VI 

(94 19 17 84 
66 04 04) 



(10 4o 99 48 82 
95 20 ) 

Figure 112. 

Ve vlU notf arbitrarily assume that the initial 10c in the second sequence 
represents lOp; this of course gives us an additive of 00 for col. II. 

The 94c In the Initial position of the first sequence must also represent 
lOp, so therefore the additive for col. Ill has to be 84. This additive, 
when applied to the second dlnome of the second sequence, 40c, deciphers 
It as 6^. This zigzagging process Is continued, quickly deriving the 
relative additive as follows; 
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Figure 113. 
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(2) With a relative additive at hand, ve now reduce the text of the 
cryptogram to monoeili^hetlc terms, as follovs: 

, 00 84 



4 l 30 07 04 63 53 61 21 53 79 39 04 7 ^ 34 51 93 6o 29 60 25 89 68 74 34 

50 30 23 51 92 46 70 21 79 26 68 97 83 34 77 40 99 12 79 25 05 15 03 27 ^ 

83 51 94 19 17 84 66 04 04 53 24 20 42 92 20 23 92 55 11 26 36 92 13 69 

10 66 J|6 77 75 04 20 00 












13 05 99 56 98 09 
22 05 15 03 27 92 

04 66 60 80 16 71 
13 66 86 37 45 64 

71 42 72 78 97 37 
80 42 98 25 26 20 

19 10 91 25 31 37 
28 10 17 72 60 20_ 

U 34 45 06 4 o 69 
JO 34 61 53 79 52 



42 10 4 o 99 48 82 95 20 72 75 24 12 

51 10 66 46 77 75 04 20 98 22 53 05 

42 48 72 78 03 17 44 13 35 45 17 87 

51 48 98 25 32 00 53 13 51 92 ^ 70 

84 80 26 56 86 89 44 26 51 28 24 11 

93 80 42 03 15 72 53 26 77 75 53 04 

17 52 23 95 23 55 83 51 94 19 17 84 

26 52 49 42 52 48 92 51 10 66 46 77 

37 16 36 83 48 55 89 

46 16 52 30 77 48 98 

Figure U4. 



42 92 20 23 92 90 
51 92 46 70 21 83 

12 48 04 04 91 95 
21 48 20 51 20 88 

11 80 85 36 08 83 
JO 80 01 83 37 76 

66 50 11 17 24 11 
J5. 50 37 64 53 o4^ 



All of the polygroEAile repetitions orlglxially present In the plain text are 
nov disclosed. Since the matrix Involved is the saw as that In Fig. 101 
except that the coordinates have been scrambled, ve must make sow plaintext 
assumptions. 7^ best assumption for the repetition 20 26 52 49 42 52 Is 
P 0 S IT ION S, based not only on the Idlomorph present, but also on the 
fact that the first two dlnows begin vlth the saw digit (P and 0 are In 
the saw row of the matrix); moreover, by the tlw ve have recorded the 
coordinates for the values P, 0, S, and IT, the dlnow 42 autowtleally 
gives the value ION, thus furnishing conflrwtion of the validity of the 
plaintext assumption. Sie derived coordinates are placed In the proper 
positions outside the basic matrix, so It now looks like this: 

6 2^9 
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From here on the rest of the solution foUovs easily, the declidiered rallies 
furnishing clues around vhich to make a fev further assun^tions until all 
ten row and column coordinates are recovered. For escample. the repetition 
^ 9 Z U 6 10 21 (the middle dinome of which deciphers to Ip) must begin with 
one of the R or 3 groups of row If 51 represents BE, then 21 automatically 
deciphers as NT, suggesting that the repetition represents BE G 1 14 E NT, 
especially since the cdimin coordinates for G and MB have already been placed 
by the first assumption. 

( 3 ) Since the additive recovered is on a relative base, so are the 
reconstructed coordinates on a relative base. Die actual additive was l 4 
23 07 76 30, which can be derived from our recovered relative additive 

by adding a corrective of 23 to all the dlnomes of the key; the matrix 
coordinates would then be changed by adding 6 to all the row coordinates, and 
7 to all the column coordinates. But there Is no way of deriving or of 
proving the correct base; besides, this point Is only of academic Importance. 

k. nie Initial entry in the example In Fig. U 4 was made by means of 
a repetition which was Identified as representing FOBITIQNS; this pat solu- 
tion may appear to the student as a very fortunate piece of hindsl^t indeed, 
in view of the fact that the author made up the problem. For the skeptical 
reader with a Jaundiced eye, there will now be presented a mathematical 
method of arriving at several row and column coordinates (thereby Identifying 
a number of plaintext values In the cipher), without recourse to any plain- 
text assumptions whatsoever. 

(1) If the matrix In Fig. 101 were a known matrix, recovered from pre- 
vious solution, a tabulation could be made of the frequencies of occurrence 
of the various plaintext elements within the matrix. Such a tabulation is 
shown In Fig. 115 , below, wherein are listed the frequencies of over 1400 
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Figure II5. 



plaintext values from representative messages, reduced to a base of 1000. 



CO NF IDE HT IAL 



277 



REF ID:A64554 



OOMPIDBWTIi ffr 



Mote that the hlghest-fjrequeney element, 88 (representing Sp), has a rela- 
tive frequency of ^ In 1000 (l«e., 5*4p}; the next highest, 79 (rei^e- 
senting Fp), a relative frequency of etc. Mote also that the sums of 
the entries in the rovs have greatly vsrying frequencies, emd likewise the 
columnar sums. 



(2) Referring hack to Fig. U4, ve will now take a dinome dlstrlhu- 
tion of the monoali^hetlcally-converted text; this is shewn helow: 
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Row 2 of this dlstrlhutlon, with 27 tallies, and row 5, with 2k tallies, 
should correspond either to true row ^ (vel^t of 192; and true row 8 
(weight of 149) of Fig. 115, or vice versa; let us assume that true row 
7 (with the hl^^r score) is the correct equivalent for row 2. Col. 
with 28 tallies, should be one of the three highest columns of Fig. 115: 
true col. 8 (weight of 1^}, true col. 9 (weight of 122), or true col. 1 
(weight of 120). But cell 2-0 (with a hl^ count of 9 tallies) should 
correspond to one of the following true row -column cosibinations: 7-8 
(weight of 12), 7"9 (wele^t of 50), or 7~1 (wel^t of l). nie correct 
choice for cell 2-0 is obviously tiue 7*'9> Ihls means then that row 5 
(with 27 tallies) should be true row 8 (wei^t of 145). 



(3) Since col. 0 (which has been identified as true cd. 9) is not 
true col. 8 (which has a high welc^t of l48), true col. 8 should be col. 

2 (with 23 tallies, the second ranking column); this is substantiated by 
cell 5-2 (with a frequency of 6), which shows a correspondence with true 
8-8 (weight of 54). Mow cells (9 tallies) and 5-3 (7 tallies) should 
represent true 8-1 (wel^t of 31) or true 8-3 (wele^t of 22); in light of 
the higher nuniber of tallies (l6) of col. 3; this column should correspond 
to true col. 1 (wele^t of 120), making col. 1 (15 tallies) equal to true 
col. 3 (weight of 103). Cell 9-2 (7 tallies) should correspond to true 
6-8 (wel^t of 23) or to true 4-8 (weight of 22); but comparing row 9 
(l4 tallies) with true row 6 (wel^^t of U6) and with true row 4 (weight 
of 72), the agreement of row 9 is best with true row 4. 
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(4') FLcMlng the recovered coordinates for three of the rows 
four of the colunins In position on the oatrlx, ve have the foUovlng: 




3 




1 










2 


0 
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AL 


AN 


ANB 


AR 


ARB 
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AT 


ATE 
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ND 
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OF 


ON 


OR 
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R 


RA 
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R1 


RO 


8 


SE 


SB 
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T 
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TU 


THE TITT THR 


TI 


TO 


U 
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VE 
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UE 


X 


Y 


Z 




The plaintext values for the dinones iriu>se coordinates have been recovered 
are nov placed In the ciyptogramj yielding the foUovlng: 



50 30 23 51 92 46 70 21 79 26 68 97 83 34 77 4o 99 12 79 25 0* 

89 9 71 STw 9 73 7 4 1 9 4 8 7 

SB ND RE G NT 



1 10 66 46 



Am 



46 70 21 48 SO 






1 7 
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Not only do the skeletal plaintext values constitute a nucleus fbr further 
assumptions, but derived single coordinates for the rows or columns (such 
s^ In the second dinome where 30 ■ - 9 ) serve as a guide for the choice of 
additional values. Oie solution from here on Is very stralc^tforward. 

( 5 ) the sample of text trere large enough. It might be possible to 
recover most or even all of the row and colvunn coordinates mathematically. 

But If we are to use statistical tools Intelligently, and not merely for 
their own sake,^° we should use Just what Is needed for the quickest solu- 
tion possible. 

1. In the foregoing subparagraphs there have been treated enciphered 
syllabary square systems wherein the composition of the matrix Is known. 

If nothing were known about the basic matrix, solution would proceed by 
factoring and determining the period, and then reducing the cipher text to 
monoalphabetlc terms by one of the methods already outlined. The last step, 
that of breaking Into the reduced cipher text. Is accomplished by attacks 
based on probable words, repetitions and similar sequences, Idlomorphs, 
Isologs, and other phenomena or special situations which can and will occur, 
sooner or later, when the system Is used for regular traffic; the analysis 
of syllabary squares and code charts has been given adequate treatment In 
par. 80 of Chapter XI In Military Cryptanalytlca. Part I. and In the associ- 
ated problems (Appendix 9 of that text, pp. ^t23-427)« 

84. Additional remarks.— < 1 . The discussion In this chapter has been 
limited to superenclphered numerical bipartite systems, l.e., where the 
matrix coordinates consist of digits. If the coordinates consisted of let- 
ters, and If these letters were enciphered with, say, direct standard al- 
pAiabetB, the techniques presented In this chapter can be adapted to this 
situation because the arithmetic Is being performed on a known modulus (in 
this ease, mod 26; e.g., BfSsG, XtC>A, etc.). If the superenclpher- 
ment Involves unknown mixed cipher al^diabetB, the crdinary modular relation- 
ships do not obtain; therefore solutions must be based on a volume of traf- 
fic, plus whatever fortunate special situations may be present in the system 
as used by the eneo^. However, the majority of eases of superenclphered 
bipartite systems encountered have Involved asttrlces with numerical coordi- 
nates and mod 10 addition. 

b. The cryptograi[Aiie arithmetic treated In this chapter Is the additive 
method, where P K ■ C, cuid C - K ■ P. Ihere are two other arithmetical 
methods of encipherment: the subtractive method, where P - K ■ C, and 
C -f K ■ P; and the minuend method, where K - P ■ C, and K - C ■ P. Additive, 
subtractive, and minuend methods are complementary: em additive system nmy 
be solved as a subtractive system or a minuend system; euiy one of these may 
be solved as either of the other two. If an additive system Is assumed emd 
the cipher Is actually a subtractive system, all that will happen is that a 
complementary key will be derived (e.g.. In subpar. 821 the recovered key 
would have been 53 49 28 76 10 Instead of the 57 82“34 90 as derived) . 



See in this connection some remarks made by C. H. OTJ. Alexander quoted on p. 223 of Military 
Cryptanalytics, Part I. 
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If a minuend system is solved as an additive or subtractive system, the 
intermediate plaintext digits vlll be the complements of the true inter- 
mediate plain (with or without the addition of a constant)* In any case, 
the derived key can always be converted into the true key either (a) by 
the addition of a constant, or (b) by the addition of a constant to the 
complements of the derived key. Situations where it makes any difference 
if the correct method has not been assumed are rare; these cases usually 
involve certain aspects of key analysis, or situations wherein the true 
coordinates of a matrix are known. This natter will be dealt with at 
greater length in the next volume. 



e. It should be clear to the student that if there are any llmlta- 
tlons~"ln either the left- or right-hand components of the dlnome inter- 
mediate text, such limitations will simplify the problem of reduction to 
monoalphabetic terms. 

d. The cryptogram in Fig. 107 was factorable by means of the poly- 
graiMc repetitions patent in the cipher text. The student should note 
that if these repetitions had not been in evidence, we still could have 
factored the exyptogram by generating delta streams at various Intervals 
and examining these streams for evidences of long polygraphic repetitions; 
lAen the interval of 6 dinomes was considered, we would have the diagram 
as Illustrated in Fig. Ill, revealing from the latent repetitions now dis- 
closed that the length of the period is 12 digits. 



e. One further tool for factoring ml£^t occur to the student: the 
use of an I.G. to determiiae when the correct write-out has been reached. 

In the manner of that described in subpar* l6e. This very valuable method, 
especially rewarding in difficult cases, warrants detailed treatment; the 
application of this procedure will be taken up in the next chapter in aub- 
pars. 86b-d. 



f. Attacks based on cribs, Isologs, and other special situations may 
be devised to fit the specific situation at hand; the alert cryptanalyst 
should always be on the lookout for the possibility of exploitation by 
means of these methods in a particular case under study. 
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CHAFIEB XII 



MOHOMEJ)INCM8 SYSTBiS VIOB CXCLIC ADDITIVES 



Raragiaph 



General remarks 85 

Analysis of a general case of an additive-enciphered monome-dmome system 86 

Analysis of a second case 87 

Analysis mvolving isologs -88 

Additional remarks 89 



85- General remarks. — a. In the preceding chapter ve have seen 
demonstrated the various mel^bds of attack on dinome systems superenciphered 
hy cyclic additives. The determination of the length of the additive vas 
made bv the general method of factoring the Interval between long (i.e., 
causal) repetitions; in the case of the Nihilist system the determination 
of the period vas made by taking advantage of the cryptographic Idlo- 
ayncracles of that system (as regards the "unique dlnooms" 01, 10, 22, and 
30). 

b. The matrices in the foregoing chapter vere dinome matrices, their 
particular dimensions being Irrelevant. The reduction of the columns of 
the additive -enciphered text was accomplished (l) by equating the monomic 
distributions (cf. subpars. 82b and c ) , or (2) by equating the dlnomlc 
columns (as in subpar. &3d), or (3) % comparing sets of Identical -length 
ciphertext repetitions assumed to contain identical underlying plain text 
(subpar. 83 ^, or (4) by analysis of the delta stream at an interval corres- 
ponding to the period (subpar. 63 ^. 

e. If a cyclic additive enciphenoent is applied to intermediate plain 
text produced by a monome -dinome system, the problem gets more complicated, 
especially as regards column equating. !Rie determination of the period may 
be made by the usual process of factoring; but if no long repetitions are in 
evidence, ve must rely on denying a columnar I.C. statistic for each vldth 
that comes into consideration,^ hoping that the correct vidth vlll have a 
predominant I.C. and that there vlll be no other "good” ansvers for the 
Incorrect vldths . We might even apply the delta-stream method and vlth luck 
uncover possible latent sets of long plaintext repetitions vhlch would then 
indicate that the interval of the delta stream tried is equivalent to the 
true period or a multiple of the period; but this method is hardly to be 
recommended except in cases vhere the additive is very short in comparison 
vith the length of the message. 

d. In additive -enciphered monome -dinome systems, once the period has 
been determined, the equating of columns is accomplished by sliding the 
monomic distributions to a correct match vhen there are a sufficient nuaiber 
of tallies per column. What constitutes "a sufficient number of tallies 
per column" is dependent on the over-all I.C. of the cipher text produced 
by the underlying monome-dlnome matrix; if the matrix had the highest fre- 
quency letters in the monome row, much larger distributions vould be neces- 
sary for column equating than if some medium or low frequency letters vere 
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Cf. the method shown in subpar. 18e. 
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represented by nonones. Die problem of column equating Is all the more 
eomplleated because each columnar distribution contains a mixture of 
monpipa elements and only one of the elements of a dlnome— thus there Is 
a "watering down" of the Information that might have been available if 
the distributions pertained only to left-hand or ri^t-hand members of 
dlnomes as in the systems illustrated in the preceding chapter. 

e. If there are several messages in the same system which have been 
enciphered at various points along the keying cycle^ their correct super - 
Impositions may be deteinlned by locating long repetitions between messages 
and aligning them so that the repetitions are exactly superimposed. Other- 
wise, once the period has been detenlned, even without the presence of 
long repetitions we may still all^ the messages coirreetly by a variation 
of the X-test method demonstrated in par. T 2 . 



66. Analysis of a geneial ease of an additive -enciphered monome- 
dlnome system.- - a. In this first ease we will treat the cryptanalysis of 
a system involving an unknown monome -dlnome matrix with an additive of 
unknown length; for purposes of lllustration> it will be assumed that the 
enemy is known to be using additives from ^ to 40 digits in length. The 
following two messages are available for study: 



90723 78168 
5I8H 80725 
28147 15733 
66954 13321 
20894 16966 
11794 57037 

06260 72364 

55013 35800 
81653 45991 



60542 47550 
71001 5*^92 
06354 13674 
57217 35540 

34903 31904 
30323 83618 
67137 40325 



94849 15771 
95351 25207 
58293 45515 
61791 75797 
0^7 59634 
24849 06800 
91991 17821 
92354 04365 
26864 97666 



69060 75362 
60653 01924 
11794 57837 
01953 28138 
26742 97424 

80859 15433 

53354 15374 



Message A” 

16844 17454 

71062 43897 

05206 88337 

514 i 4 31979 

80149 82660 

00520 19613 

62194 36516 

92886 96225 

06029 44327 

Message "B" 
54662 15457 

46954 28733 

25513 51562 

90813 05530 

04573 22367 

25090 58254 

24063 75498 



66220 88312 
67340 60921 
34666 19695 
86210 85627 
81862 77470 
90147 16045 
06329 85610 
20858 05926 
74662 65027 



59157 87473 
91803 65347 
06723 19962 
07142 06526 
17863 25890 
60200 14378 



87103 45436 
05986 85348 
67818 09150 
71095 58825 
01320 13674 
20150 35129 
90458 05395 
00264 38137 



49316 85347 
43818 06626 
51163 49777 

06554 84334 
59816 42517 
9^3 49028 



There are many short repetitions inwsent, but since the causal cases cannot 
be distinguished from the random, there is no Infonnatlon in the repetitions 
to indicate the length of the period. Furthermore, we really do not know 
whether or not the two messages are even in the same system; and if they are. 
whether the messages are in flush depth or at an offset in the key cycle. 
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b . Since the additive eequenoea used by the enea^ in the past have 
been Aram 20 to 4o digits long, ve vlU transcribe Message "A", the longer 
of the two, into the various widths successively, deriving the sum of, the 
I.C.'s of the columns for each particular width. ‘ The columnar frequencies 
for Message "A” when written out on a width of 20 are shown in the diagram 
below: 



1 

2 

3 

4 

5 

6 

7 

8 

9 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 

4612451123934 3 1113 

139225 2121712151243 

4233 1214 21333 171 

4 3119311 1 242331 

116432213 31262 111 

2 5 812342121371 5 

4 4 1 1 1 1 4 2 4 4 2 4 2 6 3 1 1 4 1 

32 2312153 1 114234 

415 3322111153 43611 

5 33 143 3134223122 



0 

1 

2 

3 

4 

5 

6 

7 

8 

9 



f = 68 58 606646 587442 4052 48 684660 52 5468 5268 46 



= 1126 



Ohe sum of all the cOlumxiar ^ values is 1126. Since in writing out the 
message (44o digits) on a width of 20, we get 20 cblumns of 22 tallies each, 

the ^ is ■ 924; thus the l.C. for this width is - 1.22, which 

seems surprisingly good for a random case, if it is random. Since the crypt* 
analyst should have learned by now that it is well to regard with suspicion 
yy very good result on the very ALrst trial, he proceeds to test other widths, 
we data for the first 10 tests are tabulated belw: 





l.C. 


Width 


l.C. 


20 


1.22 


25 


0.97 


21 


0.93 


26 


0.92 


22 


0.91 


27 


0.91 


23 


1.01 


28 


1.06 


24 


1.11 


_22_ 


1.11 



n 

The process of transcribing text into a multitude of widths and making all die necessary computations u 
a laborious task when performed by hand, where machine mediods are available, this presents no problem. 
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e. Tbe next width to he eonaldered Is 30, so the nessage is written 
out accordingly, as follows: 



123456789 10 1112 1314 15 1617 1819 20 21 2223 24 252627 282930 

9072378 l 689 ^^ 8 ^^ 915771 l 68 i^^H 7 ^ 5 *^ 

662208831287103 ^ 5 ^ 36518 I »480723 

95351252077106243897673^060921 

059868534828147157335829345515 

052068833734666198956781809150 

669541332161791757975141431979 

862108562771095588252089416966 

090875963480149828608166277470 

013201367411794578372484906800 

005201961390147160452015035129 

062607236491991178216219436516 

063298561090458053955501335800 

923540436592866962252085805926 

002643813781653459912686497686 

06029443277466265027 



The dlagraa for the columnar frequencies at this width is given below: 



1 2 3 4 5 6 7 8 9 10 U 12 13 14 15 16 17 18 19 2021 2223 24 2526 27 282930 



0 


932151 11 321 1 2 


1 31 




232 24 


1 


1 113 231164 25 


31323 


2 12 2 1 


2 


156 1113112 2 114 


511 




1 4 


3 


4 1127311 2 1131 1 




2 4 


4 


312 13 2 i 4 i 3 11 


11461 2 1 


5 


313 l4 1 2127 


5 4 1 


2 


4 2 2 2 


6 


26 22 53 1 33212 


132 


2 


13114 


7 


1 12 15312 212114 2 




1312 


8 


1 2 54 2312111161 


118 




2 1 2 1 


9 


312 2 2 5 1421135 




3 1114 2 



1 

2 

3 

4 

5 

6 
7 
6 

9 







f = 8042 364030 28 3064 242832 40 243212 28 46 3838 3838 16 58 28 36202620 2028 £i = W2Q 



The sum of all the columnar ^ values here is 1020. Since we have 20 columns 
of 15 tallies and 10 columns of l4 tallies, ~ - 602, 

and the I.C. is therefore = I.69. With such a hle^ I.C., there is no 
question that the correct period is 30. 



I 
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d. We new transcribe Message "B” on a width of 30 u shown below, 
togetter with its acecHupanylng frequency diagram: 



59157 

60653 

43818 

25513 

57217 

07142 

26742 

59816 

25890 

67137 



6 7 8 



475 
874 
019 
0 8 6 
515 

3 5 5 

065 
974 
425 
5 8 2 
403 



9 10 11 12 13 14 15 16 17 18 19 20 21 2223 2425 26 27282930 



7 3 4 
2 4 4 
2 6 0 



O £ U 

4 0 0 
2 6 0 
2 4 0 
17 3 

5 4 6 
2 5 5 



9 0 
9 3 1 
6 9 5 



19 5 
6 5 5 
^ 5 7 
0 3 2 
0 2 0 
3 3 5 



0 7 5 
6 8 5 
4 2 8 
4 13 



3 

3 2 8 

4 8 4 

3 2 2 

3 8 3 
0 1 4 

4 15 



3 4 7 
7 3 3 
6 7 4 



^ o e 

138 

334 

367 

618 

378 

374 



4 

71001 

91803 

11794 

5116 

90813 

34903 

17863 

80859 

99263 

24063 



15457 

54092 

65347 

57837 

49777 

05530 

31904 

25890 

15433 

49028 

75498 





1 2 3 4 5 6 7 8 9 10 11 121314 1516 17 1819 20 2122 2324 2526 2728 2930 

^ rn 131 252112 223 I 2 1 2 1 0 

1 34 21 1 1 4 11 2411121 1 

23131151 1231 21111 112 

1 121 1 1114 4 26311 71 13 

1 3321321 42133 12131 

322221521125 3 2 1 

311 1 111224 11 23 15 

31 3 3 11 11 1 132111 
3112 32 314 

2111 22 11 3111 - 



4 = 1812 14 20141410 22 22 102416 16 22 26 2412 32 18 1610 2014 26 42 6 321012 16 = 550 

The Is 550 ; the ■ 330 . The I.C. is ^ = I. 67 , which 

proves that 30 is the correct period for this message eLLso. 

e. New cGmes the problem of determining the relative Juxtaposition 
of the two messages (if they are indeed homogeneous) . Following the gen- 
eral procedure Illustrated in par. 72 in connection with progressive alpha- 
bet systems, we will match the columnar fteguency diagram of Message at 
all possible offsets with the columnar frequency diagram of Message "A", 
deriving the columnar %values for the '’CcAumos at each Juxtaposition.^ The 
first test is shown below: 



^ A cut-out mask, exposing corresponding cells m the two frequency diagrams, will be found useful m 
avoiding errors in deriving the cross products. 
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123456789 10 11 1213 1415 1617 1819 20 2122 23 242526 272829 30 



1 2 




9 10 11 12 13 14 15 16 17 18 19 2021 22 23 2425 2627 282930 



0 




[1212 


131 252112 


223 


1 2 12 


1 






3 4 




2 1 11 




4 11 2411121 


2 


3 Li 


113 1 


3 


1151 12 




31 2 11 


11 11 


3 


Hi 


[3 1 


1 121 1 1114 


4 


26311 


71 131 


4 


1 7 




1 3 




3 21321 


4 


2133 


121311 


5 


3 zLi 


1 


3222 




215211 25 




3 2 1 


2611 


6 


3 iZ] 


f 


311 


1 


1 1 1 2 2 4 1 


1 


23 15 


1 


7 


31 ] 


fl 4 


3 1 


3 


311 11 




1 132111 


11114 


8 




f ^ 


3 


1 


1 2 




32 3 14 


2 2 


9 






2 1 




11 2 2 




11 31111 213 1 






15 20 8 10 12 14 13 13 23 19 3 14 6 14 14 24 27 10 13 9 16 23 37 18 2215 30 17 10 9 



1 

2 

3 

k 

5 

6 
7 
6 

9 



The sum of the columnar 7C values at this juxtaposition Is 478. The expected 
sum of the cross products in a random case, Is . I|d4^ 

so the §I.C. at this particular aligomeat of the two messages is > O.99. 

f . We now slide the ft^quency diagram for Message "B” one position to 
the right with respect to the diagram for Message ”A”, and ve derive the 
fl.C. for this setting. This 1.04, is likewise void of cryptana- 

lytlc pith. After 20 unsuccessful trials,^ on the 21st we finally reach the 
setting Illustrated below: 



A 

The student might wiA to see the results of the first 20 trials. These are tabulated in the diagram below, 
wherein the entries under "dide" indicate the displacement of the frequency diagram for Message "B" to the 
Tight with respect to the frequency diagram for Message "A". 
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1 2 3 4 5 6 7 8 9 10 11 12 1314 1516 17 18 19 20 21 22 2324 2526 2728 2930 



0 


9 


32151 11 321 1 2 


1 31 




232 24 


1 




1 113 231164 25 


3 13 2 3 


2 12 2 1 


2 




156 1113112 2 Il 4 


511 




1 4 


3 




4 1127311 2 1131 1 




2 4 


4 




312 13 21413 11 


1 1 4 6 1 2 1 


5 




313 14 1 2127 


5 M 


2 


4 2 2 2 


6 


2 


6 22 53 1 33212 


132 


2 


13114 


7 




1 12 15312 212114 2 




1312 


8 


1 


2 54 2312111161 


118 




2 1 2 1 


9 


312 2 2 5 1421135 




3 1114 2 | 




0 

1 

2 

3 

k 

5 

6 

7 

8 

9 



11 12 13 14 15 16 17 18 19 20 21 2223 24 25 26272829 30 


1 2 3 


4 


5 6 7 


8 9 10 


29 30 


(52112 


223 


1 2 12 


1 2 




131 


2j 




[ 1 1 


4 11 24111 


2 1 


3 4 


2 


1 




1 12 


31 2 111 


1 11 


3 1 




3 1 


151 




7 l 1 4 4 


26311 71 131 


1 


1 


2 1 


1 1 


73 1 


72 1 4 


2133 1 


21311 


1 


3 


3 


213 


rjl 1 


Zl 2 5 


3 2 1 


2611 


3222 


21521 


,(l 


72 4 11 


2‘3 1 5 


1 


311 




1 1112 


( 


7 11 


1 132111 


11114 


3 1 




3 3 


1 1 


Yjl 4 


y 


32 3 14 


2 2 


3 




112 




it ^ 


722 


11 31111 


213 


2 


2 ^ 


1 


1 


r73 



= 4933 30 31 283231 54 25 282537 22 2421 23 4624 30 1936 16 31 31 11 18 20 19 29 21 



V 

1 

2 

3 

k 

5 

6 

7 

8 

9 



H«:. th. of the col»-ar croe. protoct. U 8tt, «, the *1.0. U ^ • l.ft, 

proving that the tvo messages are homogeneous after all, and that they may he 
correctly Juxtaposed as Indicated. 




g^e We may nov consolidate the corresponding columnar distrihutions of 
Message "A" and Message "B", in order to obtain more data and thus facilitate 
the eg;uating of the monomic distributions by sliding them to the best fit. In 
Fig. 117^ below, ve show the consolidated data for the first 6 columns of the 
combined distributions; and in Fig. 117b we have equated these distributions 
in terms of col. 1. This process is continued with the remaining columns; and, 
since we happen to have plenty of data to work with, the entire additive is 
obtained q\iite easily, yielding the following 20-digit sequence: 

06920853349166315^972781407526 

This is probably a relative additive; there is no way of proving at this point 
which one of the ten eqid.valent additive sequences is the original. 
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Col. 1 : 
CdL. 2 : 
Col. 3 : 
Col. U: 



s .. 

0123^56789 



|l« ■ 

0123^56789 



9 ^}l ■ . B 

0123456789 



- -i* , 

0l23^^56789 



! .... .. 

Col. 1 : 0123456789 



|l ■ 

Col. 2 : 6789012345 



B9 9 - 

Col. 3: 9012345678 



pi -- 

Col. 4 : 2345678901 



Col. 5 : 




5678 



9 



Col. 5 : 



Ol 23 f 56789 



Col. 6 : 



_^S 9 i 

012345678 



Col. 6 : 




-3a- 

0123 



456 



Figure 117a. Figure U 7 b» 

h. Baring recovered the additive, «e proceed to apply It to Meaaage "A" 
to reduce the cipher to nonoalphabetle terms* The first 60 digits of the 
message and their conversion are shown In the Illustration below: 



069208533491863154972761407526 
C: 907237 bl 689484915771 l 664417 ‘i- 5 ^ 
P: 948039383403086003849903010938 



C: 662208831287103454365184480725 

P; 603000308896340300493403083209 

Once the entire cryptogram has been reduced to nonoalphabetle terms, the 
solution is quite stral^tfbrward, following the lines already discussed 
at length In the previous text.^ The digits 0 and 3 are Identified as row 
coordinates, and when the converted text is divided accordingly the plain 
text Is recovered, with Message "A" beginning with the words '^REPORTS OF 
INTERROGATION..." The monome-dlnome matrix is reconstructed as follows: 



9481276503 

- |R £ P U B LTcIH 
^ ADFGHJKMNO 
3 ttSTVWXYZ . 



Since the additive sequence has probably been recovered on a relative base, 
the matrix coordinates are also relative. 



° Cf Chapter X, Military Cryptanalytics, Part I. 
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1. In order to Illustrate the general theory and techniques of solu- 
tion of an add.lt Ive -enciphered, monoms-dlnome system, «e have used in the 
foregoing exsmple a matrix with a very favorable I.C. This facilitated the 
step of matching monomle distributions in subpar. If the moname-dlnome 
matrix had cryptanalytlcally unfavorable characteristics, ve would probably 
have required considerably more depth than the 26 lines of text ve dealt 
with in subpar. £. The reason for the qualifying phrase is that, even with 
an unfavorable I.C. (which makes equating of monomic columns difficult and 
precarious) , the presence of numerous repetitions in the underlying plain 
text at various positions in the keying cycle would facilitate the equating 
process, once some of these repetitions began to be uncovered in the process 
of solution. 



J,. In subpars. e and f we have shown a sensitive method employing 
the X test for determining ^ correct Juxtaposition of the firequeney dia- 
grams for the two messages j this method was demonstrated for pe d ag ogical 
reasons, since it is the method which would have to be employed in a diffi- 
cult case. It wrtght- be pointed out, however, that as a short cut we could, 
have taken into account only one pair of corresponding rows (instead of the 
10 pairs as in the example presented) of the two frequency diagrams to deter- 
mine their relative placement. For exaa^le, if we consider only tto^ 0 rows 
in the illustration in subpar. e^ we should expect that the entry "9" in 
position 1 of Message "A" will be aligned with one of the highest entries 
in the "0" row of Message "B". In this case, our first trial of "9" in Mea- 
"A" against the "5" in Message "B" gives an excellent fit of the two 
sequences of digits as regards their corresponding peaks and troug^. Ihe 
X value at this Juxtaposition of the two rows is Ulj since the "0" row of 
Message "A" contains 50 tallies and the "0" row of Message "B" contains 34 
tallies, the value of 50^4 . 56 . 6 , and the \ I.C. is ■ 1.96. 

If ve have to choose between two or more high scores obtained by this 
method, this preliminary test could be checked by performing the test 
on several entire columns of the diagram. 



87 . AwA^iysis of a second case. — a. If an additive -enciphered monome- 
system were used operationally, it is quite possible that the basic 
rectangle and coordinates might remain in force for a considerable period 
of tlma, so that cryptographic clerks might more easily memorise the equiv- 
alents for most or all of the letters and thus speed up operations. In such 
a case then, the only nmjor variable element in the cryptosystem would be 
the length and coBDOsltlon of the additive aequenee used to encipher the 
intexmediate tex^ If the basic matrix bec(»ms known throuf^ previous 
solution, ve may have recourse to a statistical method for reading traffic 
enciphered with the same matrix but with an unknown additive. 



b. Let us assume that the enemy is still using the same monome-dlnomB 
matrix which was recovered in the previous paragraph, vis. : 

9461276 



REF 
A D F 
Q S T 




Another variable might be the specific starting point in the additive cycle 



«GHF19ENXIAL 
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since the ten cipher digits have greatly ▼arylng probabilities^ ve can 
calculate a set of weights which will be xaost useful In solrlng further 
systens Incorporating the same matrix. 71 »t we shall replace the plain- 
text entries of the matrix with their theoretical fireqiaencles In 1000 
letters,*^ thus: 

9^8l2765j<3 
- 1 76 130 27 26 10 36 ~W 3 r|HB| 

0 7 ^ 42 28 16 3 *^ 2 3 25 79 751 

3 I 3 61 92 15 16 5 19 1 I 

The theoretical frequency of the digit 0 'will be the sum of all the entries 

In the ”0" row, plus the entries In the column; this Is found to be 4 ^ 7 . 
The theoretical frequency of the digit 3 vUl likewise be the sum of all the 
entries In the " 3 " row plus the entries In the " 3 " column; this Is 287 • The 
expected frequencies of the remaining digits will be the sum of the entries 
In each of the columns corresponding to the particular digit. Thus the theo> 
retlcal distribution of the 10 digits obtained In the encipherment of 1000 
letters of JBngllsh plain text will be as follows: 



57 57 60 287 233 57 



3 1^^7 153 



These frequencies will be used In the derivation of logarithmic vele^ts, 
following the general procedure outlined in subpars. 3^ wid e on pp. 83-85 • 

e. In the table below, column (a) represents the frequencies of the 
ten digits comprising a plaintext "alptobet" of 10 categories; col. (b) 



(a) 


(b) 


(c) 


(d) 


W 


2.6599 


1.0264 


.99 


57 


1.7559 


0.1224 


.12 


60 


1.7782 


0.1447 


H 

• 


287 


2.4579 


0.8244 


.80 


233 


2.367^ 


0.7339 


.71 


57 


1.7559 


0.1224 


.12 


96 


1.9823 


0.3^ 


.34 


43 


1.6335 


0.0000 


.00 


147 


2.1673 


0.5338 


.51 


153 


2.1847 


0.5512 


.53 



represents the logarithms (to the base 10} of these frequencies; col. (c) 
contains adjusted logarithms, obtained by subtracting the logarithm of the 
lowest frequency ( 43 ) fTcm all the entries In col. (b), which Is equivalent 
to dividing all the entries In col. (a) by 43 ; col. (d) contains two-digit 



' Cf. p. 28, Military Cryptenalyucs, Part I, 

^ The purpose of this step is to reduce the lowest frequency, 43, to 1 on an arithmetical scale. 
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logarithms to a new base (10.88); and col. (e) represents deelban weights 
of eol. (d), obtained by sultipl^ng the entries in col. (d) by 10 and 
dropping the decimal point. !Itae new base, C, is derived as follows: 







Then (Logio*^57 - I«ogio*»3) - LogioC®*^ 



= (0.99 )(Lo 8 ioC) 



C * AntUog (Loglo*^57 - I*og].o*^3) • AntUog 

0^99 



AntUog 1.0368 



C = 10.88 



Logarithms to a new base may be computed by the formula 

LoglpY 
LoglO® 




Therefore if the entries in col. (c) are divided by I.0368, we obtain the 
figures in col. (d) which are logarithms to the base 10.88. 

d. For a demonstration problem, we wUl use Message *%" given in 
subpar. 86a^ we will assume that the additive is unknown, but that the 
monome-dlnoms rectangle has been recovered from other messages. Since 
the message factors to a period of 30, it is written out on this width: 

1 2 3 45 6 7 8 9 10 U 12 13 14 15 16 17 18 19 20 2122 232425 2627 28 2930 

605^2475506906 0 753625 ^^ 66215^57 
5915787^73^9316853477100154092 
60653019244695^2873391803653^7 
438180862606354136741179457837 
255135156206723199625116349777 
572173554001953281389081305530 
071420652606554843343490331904 
267429742404573223671786325890 
598164251730323836I88O85915433 
258905825460200143789926349028 
671374032553354153742406375498 

e. Consider the digits comprising col. 1: one of the ten possible 
additive digits, when applied to the cipher digits of eol. 1, wUl yield 

a set of plaintext digits belonging to the theoretical distribution (given 
at the end of subpar. ^ of our known matrix. This gives us our cue for a 
modus operand! , and we once again bring to bear the versatile and valuable 
tool of the generatrix method. The top row of Fig. U8a, below, consists 
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of the digits of col. 1. In the succeeding nine raws ve have cooitleted the 
nonasl nunerlcal sequence; this Is equivalent to trying all ten digits as 
additives for the column. In Fig. 11^, ve have replaced the digits of 
Fig. Ute by their declban equivalents~terlved In subpar. c.^ The sums of 
the log velc^ts given at the right of Fig. 11^ provide a means for evalu- 



Generatrices 


Declbans 


£ 


65642502526 


31371191113 


31 


76753613637 


03018318380 


35 


87864724748 


50537017075 


4 o 


98975835859 


55501581515 


4 l 


090869^6960 


95953573539 


63 


10197057071 


19150910901 


36 


21208168182 


11195135151 


33 


32319279293 


81815105158 


^3 


43420380304 


78719859897 


78 


54531491415 


17181751711 


4 o 


Figure 11 ^. 


Figure 11 ^. 




atlng the relative merits of each decipherment (l.e., each rov) In Fig. U 8 a 


on the same row as the corresponding log weights In Fig. U 8 b. The predomi- 


nantly hi£^ score of 78 Indicates that the first cipher digit, 6 e, should be 


a 4 p; therefore the correct additive for col. 1 Is 2 . 




f . The completion diagrams and the log vei^tlng for 


the next nine 


columns of the cryptogram In subpar. 


d are shewn belovt 




09035776957 


95981003510 


4 l 


1 


19173550935 


48 


2 


11110555105 


25 


3 


81835995159 


63 


4 


78705119851 


52 


2 * 5 


17159111791 


43 


6 


31351881118 


4 o 


7 


03091778317 


46 


8 


50518117081 


37 


9 


55517331573 


45 



g 

The easiest procedure here is to complete the log sequences vertically, starting at the proper mitial point 
determined by the appropriate digit in the top row of Fig. 118a. If desired, strips may be prepared as an aid 
in this process. 
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|1685217881 

7 

8 



1 

2 

3 

k 

»t55111^4l93 

5 

6 

7 

8 

9 

0 

1 

2 

3 



113 ? 11105?1 Zk 
31053815551 37 
08590785998 68 
57515179117 49 
51915311111 29 
93189031883 53 
10171508770 37 
15811557115 4o 

85738951335 57 

79107193009 ^ 

71111177158 ko 
13311111197 29 
30088833811 43 
05577700713 te 
55511155180 37 
59933355375 57 

91100099015 35 
11155511539 37 
18855511501 4 o 
87799988951 80 



27383722607 

3 

k 

5 



9 

0 

1 



10858011390 36 
85757588015 59 
75191577515 53 
19313911589 50 
31010133971 29 
01585100111 23 
58575855138 60 
57919755807 63 
91131199751 47 
13101311153 20 



48005309454 

5 

6 

7 

8 

9 

0 

1 

2 

3 



75991895717 68 

15113719131 33 

39110111303 23 
01885381050 39 
51775078555 55 

58119517595 56 
97331531919 51 
11001903111 18 
13558150181 38 
80557155878 59 



QGSS&amUr 
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7181567280 

9 

0 

1 

7 - 2 

3 

k 

5 

6 



00151130159 26 

55151305851 39 

55898055791 62 
99717559118 62 
11111591317 31 

11383911081 36 

88070118573 48 
77515187510 47 
11535871935 48 
33909713105 4 l 



8 . 



54965554523 

o 



7 

8 



9 

0 



1 

2 



3 

4 



17531117118 36 
31903331387 4 l 
03150003071 20 
50155550513 35 
55895555530 55 

95719995905 68 

19111119155 35 

11381111159 32 

81078881891 59 
78517778711 59 



7226422152 

7 

8 



1 

2 

3 

4 



10113711111 18 

35880188138 53 
05775377807 56 
59115011751 36 

51339533153 41 
91001500390 28 
18551955015 45 

17558155515 48 
81997199589 75 
73111811971 40 



03462064745 

1 

2 

3 

4 

10 . ^ 

6 

7 

6 

9 



98731937071 55 

17108101513 28 
11357153530 34 
83051850905 44 
70593795155 56 
15510115159 34 
35915319891 54 
09185081711 4 l 

51179571118 46 
51811518387 48 
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£. In the generatrices for some of the ecltunns there Is only one 
outstandingly high score which leaves but little doubt as to the validity 
of the selection of the proper generatrix, such as the hl^ score of 78 
for col. Ij 80 for col. 4 ^ and 73 for col. 9 *^^ In other columns, such as 
col. 5 (with three close scores of 63, 60, and 59) axid col. 10 (with the 
close scores of 36, 33 , and 34 ), there are two or more possible choices 
for the correct generatrix. What we will do Is to set down the possible 
plaintext digits for the first 10 digits of the cryptogram, and try to 
get started with a good plaintext fragment. From the foregoing generatrix 
diagrams, the following are the possible plaintext digits for the first 10 
ciphers: 

1 23456789 10 

C: 6054247550 
P: 4373949034 
6 0 0 

3 6 

We proceed to take the various possibilities Into consideration, and we 
make trial decipherments as follows: 

1 . 4/3 7/3 9/4/9/O 3/4/ 

EX Q E R 0 E 

2. 4/3 7/3 8/4/9/0 3/4/ 

EX T E R 0 E 

3. 4/3 7/3 3/4/9/0 3/4/ 

EX 7 £ R 0 E 

4. 4/3 7/3 9/4/0 0/3 4/ 

EX Q E N S 

5. 4/3 7/3 8/4/0 0/3 4/ 

EX TEH 8 

On the fifth trial, the beginning of the word EXTENSIVE manifests Itself, 
and we are off to a flying staart. We derive the additive, and decipher 
down the eoluoms, yielding the following decipherments: 



In order to appreciate the significance of the scores, we should know the expected score for a correct 
generatrix, as well as the expected score for an incorrect one For a correct case, the expected score is cal 
culated by multiplying the probability of each digit by its log weight, summing the products thus obtamed; 
this sum IS then multiplied by the number of digits in the generatrix. In a random case, the expected score 
IS the sum of the log weights in the scale (40) divided by 10, multiplied by the number of digits in the 
generatrix. Thus, the expected score in a conect case is 6. 3N, and the random score is 4N, where N is the 
number of digits in the generauix (See also footnote 2 on p. 85. } 



— fWTPEmrftTi _ 
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2781^07526 

V 3 7/3 8 /Vo 0/3 V 
EX TEN S 



5 9 1 5 7 8 7 7 3 , 

3 2/3 V 3 8/0 9 / 5 / 7 / 
S T ACL 



6065301924 
4/3 8/4/9/O 4/4/0 8 / 

T E R 0 E F 



4381808626 
2/6/0 0/4/0 1/1/0 0/ 

1 N E G U N 



2551351562 
0 8/7/0 9/5/4/O 4 / 6 / 

L A G E D I 



572173 5 5 4 0 
3 0 4/0 3/3 8/0 2/4/ 

0 T H E 



0714206526 
8/0 3/3 8/0 9/0 0/0 

0 T A N 

2674297424 
0 9/9/3 8/9/0 9/0 8/ 

R T R A F 

5981642517 
3 2/0 O/2/4/5/O 9/1/ 
H BEG A U 

2589058254 
0 8/0 8/6/5/I/7/3 8 / 

F 1 C U L T 

671374 . 0325 

4/0 3/2/3 4/3 8/0 9/ 

0 B S T A 



She rest of the solution foUows easily hy extending the plain text already 
recovered. 



h. The foregoing figure has given us a clue as to the nethod to be 
followed when ve have a placed crib, either at the very beginning or the very 
end of the message. If ve had had the probable word EXTENSIVE as a stereo- 
typed beginning, we would have obtained the same results. If, however. 
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a crib had to be dragged ttaroue^umt a meBsage, the procedure la quite 
laborious. In the absence of words, ve could drag short plaintext frag- 
ments through the cipher, and examine the decipherments at cyclic recur- 
rences of the key.^i For example, suppose ve were to drag Tldi, represented 
by the digits 3860300, through the message under examination. If ve start 
TIQN at the fourth clfAier digit (as being the earliest position TION could 
reasonably be expected to occiir), ve would get the decipherments shown In 
Fig. 11^. We then slide the orlb over one position, and we get the de- 
clidiermrats shown In Fig. 11^. 



6 0 



1 4 8 

rs 



7 2 

5 4247550 6 

/i B/6/0 I/O 01 
T I 0 H 

59157874734 
4/3 0/0 2 /2/3 

a H B 

60653019244 

R B £ li L E 
43818086260 
0 4 / 2 / 1 / 4 / 7 / 6 / 

B U E L 1 

25513515620 
0 9/7/4/3 1/2/ 
LEVS 

57217355400 
0 3 5 / 8/3 9/0 
P Q 

07142065260 
3 8/2/9/3 7/6/ 

B R X I 

26742974240 
3 8/1/0 2/7/4/ 

U H L E 

59816425173 
0 2/6/5/3 6 / 7 / 

I G Y L 

25890582546 ' 
8 / 6 / 7 / 1/0 0 / 4 / 

I L U N E 

67137403255 

2/3 6/3 1/7/5/ 

Y V L C 

Figure U9n. 



10 



605 
591 
6 0 6 
438 
255 
572 
071 
2 6 7 
598 
258 

671 



9615206 
4 2475506 9. 
/3 b/^/0 3/0 0/ 
TION 

578747349 

8/2/6/9/5/3 8/ 

B I R C T 
530192446 
4 / 4/0 4/0 4/8/ 

ED DP 

180862606 
9 / 4 / 7 / 1/0 6/4/ 

£ L U K E 

135156206 
4 / 9/0 O/ 4 / 2 / 4 / 

R N E B £ 

173554001 
8 / 7 / 4/0 2/0 4/ 
LE H D 

420652606 
3 4 / 5/0 0/6/4/ 

C R I E 

429742404 
3 3 6 / 9/0 4/4/ 

R D E 

164251730 

7 / 8 / 1/0 9 / 7 / 7 / 

P U A R R 

905825460 
1 / 9 / 7 / 7/3 4/0 

R L L S 

374032553 

8 / 8 / 9 / 8 /O 5 / 9 / 

P R P H R 

Figure 119 b. 



11 



The procedure here would be to derive a trial additive and write this additive on a slip of paper, then 
slide the additive down the column, noting what decipherments result. These decipherments are than 
partitioned mto monomes and dinomes as far as possible, and the equivalent plaintext letters are judged as to 
their relative merits. 
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The patient cryptanalyst vUl^ on the 136 th trial, reap his Just reward 
when he finally uncovers the following stretches of good English plain 
text: 



60311247590690 

5915787473^93 

6063301924469 

4381808626063 

2351351562067 

3721735540019 

0714206326063 

2674297424043 

3981642317303 

2389038234602 

6713740323533 



6075 
1683 
3 4 2 8 

5413 

2319 

5 3 2 8 
3 4 8 4 
7322 
2383 

0 0 14 

5413 



3 - 4.91 Bp 

1 6 2 3 4 6 6 2 1 
3 8 / 6/3 8/0 9 / 

I T A 
i 47710015 
1/3 8/0 2/4/8/ 

T HEP 

33918036 
0 9/0 0/0 4/0 

N D 

74117943 
4/0 2/0 9/3 1 / 

H A V 

62511634 
/3 B/ 6/0 3/0 0 / 

T I 0 N 
38908130 
0 4/0 9/0 5/0 

A M 

4 34 90 3 3 
0 4/3 1/4/0 

V E 

7178632 
3 2/6/0 0/0 

I H 

8808391 
8/4/9/9/0 9 / 6 / 

E R R A I 

78992634 
4/4/0 8/4/0 0/ 

E F E H 

74240637 
4/0 3/3 2/0 0/ 

OWN 



3 3 
0 

3 6 
3 

6 1 



5 

4 

5 
7 
9 
5 
1 
5 
5 
9 
5 



437 

092 

347 

837 

7 7 7 
530 
9 0 4 
890 

433 

028 

498 



Figure U 9 |c. 

If we were unlucky with TIQN, we would try other polygraplilc cribs. As a 
last resort, we ml^t even have to be content with dragging the digit equiva- 
lents of plaintext digraphs, such as TH, IB, OR, etc. (Digraphs such as RE 
and ER would be unsatlsfhctory, because the conponent letters are represented 
In the rectangle by nonones, so our decipherments would be next to useless— 
In fact, useless.) 




* 
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1. As an illustration of tbs effsctlveness of testing even a abort 
crib through a cipher text, let us consider dragging the digraph IH (which 
has the tetranooB equivalent 3302} through the message we have been using 
as an example. In Fig. 120a, below, we assume that TH begins the message; 



Scores 



1^0 5 ? 2 4755 0.... 


» • 


/3 fl /0 2 / 




T H 




5915787473 

2/7/6/3 


7,8 


L 1 


6063301924 
3 8 / 1/3 




U 


6 


4381608626 
1/1/3 9/ 


6,2 


U Q 


2351351562 
9/3 0 / 9 / 


8 


. R 


5 7 2 1 7 3 5 5 4 0 
2/5/7/9Z 


7,7,8 


C L R 


0714206526 

7/5/6/2Z 


7,8,4 


CIS 


2674297424 

9/4/2/2/ 


9,4,4 


EBB 


5981642517 
2/7/3 9 / 




L q 


7,2 


2389038234 
9/3 3/7/ 


0,7 


% L 


6713740325 

3 5/6/1/ 


. JA 


I U 



7 

8 



2 



1 



1 



2 

6 

2 

6 



1 



1 



5 3 
5 3 
8 7 
3 6 
9 9 
8 1 
4 3 

2 3 

3 6 

4 3 

5 3 



4 9 18 

6rnT6 

8/6/3 8/ 

I T 

1; 7 7 1 0 0 

iimJi 

T H 

339180 

9/0 0/0 

N 

741179 

0 2/0 9/ 

A 

623116 

8/6/0 3/ 

I 0 

389081 

4/0 9/0 

A 

343490 
0 4/3 1/ 

V 

671786 
3 2/6/0 
I 

168083 

4/9/9/0 

R R 

769926 
4/0 6/4/ 
F E 

7 4 2 4 0 6 
0 3/3 2/ 
w 



Scores 



2 

8,9 

1 



3 

8 

4 

8 

3 

6,6 

3 

8 

3 

5 

3 

8 

9 

8,8 

3 

6,9 

3 




Figure 120a. 



Figure 12CA . 



we derive the additive and decipher down the columns, and we partition the 
Intenaedlate plain text as far as we can with assurance— then we decrypt the 
partitioned plain as shown. In Fig. 120^ where the TH happens to be placed 
correctly (startlxig at the 30 th digit), we get the decipherments shown in 
that figure. With so much depth, it is no problem to pick out the correct 
case by eye from among a set of trials. If, however, the cryptanalyst were 
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tasting a mieh sballower depth (l.e., fewer repetitions of the keying cycle), 
a statistical vele^tlng of the deelf^roents would, be necessary to enable 
recognition of the best ease or eases from among the many trials. The scoring 
of the deelidieniients In Figs. 120a and b Is aeeoBQlished by assigning to the 
deciphered plaintext letters (leas the original XH) the deeiban veldts given 
in subpar. 3^ (excluding the period for which no weight has been calculated) , 
summing these*wele^ts, and dividing by the nudber of monones aztd dlnomes ex- 
posed in the partitioning process— this yields an average for the colinnn. 

Thus, in Fig. 120a, the sum of the weights of the decrypted plaintext letters 
(including a weif^t of 0 for the nonexistent dinone 33 ) > is 123; the nunber 
of Intermediate plaintext groupings (excluding the dlnome 30 representing a 
period) Is 21; therefore the average score is ^5 ■ 6.0. In the ease of 

Fig. 120b, the sum of the weights of the decrypted letters is 106, which when 
divided by l4 (the nunber of intermediate plaintext groupings In this ease) 
gives an average of Since the expected average score for an Incorrect 
case is 3*8, and the expected average score for a correct case Is 7*8,^^ it 
Is clear that Fig. 120a Is no better than random, while Fig. 120b is in all 
probability valid and eiui be used to extend furti^ plain text. 

88. Analysis Involving Isologa. — a. In enclidiered monome -dlnome systems, 
attacks based on the exploitation of isdLogs are particularly valuable, espe- 
cially In those eases wherein the monome-dinome matrix has a low I.C., or 
where coordinates or additive keys are changed so frequently that not enough 
homogeneous traffic 1s available for study. Several typical examples of Iso- 
log attacks will be presented in the succeeding subparagraphs. 

b. Let the following two message be examined: 



Message "A" 



8ohoi; 


3U03 


22961 


61428 


00434 


28663 


47839 


23767 


o4ioo 


20012 


07149 


90313 


87161 


34078 


16767 


04l00 


20681 


06449 


73411 


36003 


13303 


20883 


09483 


46222 


99723 


01138 


00999 


03729 


43177 


53263 


12139 


63970 


19302 


33919 


12775 


00360 


33436 


82331 














Message *%” 










04378 

6^93 


88147 




22772 


39352 


8ll40 


m 


49631 


3U42 


28849 


29231 


4o6w 


48306 


30631 


3U42 


67793 


02339 


19582 


27833 


44739 


56423 


44039 


50079 


30036 


63476 


17257 


6704l 


00207 


10986 


26224 


48220 


96496 


26203 


24434 


80478 


80368 







Both messages are of the same length, and both massages have a long Internal 
repetition beginning with the 38th and 73d digits; furthermore, there Is a 
long repetition between the two messages, beginning with the l£ 2 &. digit of 
Message "A" and the 89th digit of Message "B”. These fOienomena, among others, 
confirm the period as 33, show that the messages are Isologs, and Indicate 
that Message Is 43 on the keying cycle with respect to Message "A". 

Derivation of these constants has been diown in footnote 2 on p. 85. 
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e. !Ehe messages are xmv vrltten out as foUows: 

1 2 3 4 5 6 7 8 9 10 11 12 13 141516 17 18 19 20 2122 23 2425 26 2728 2930 31 3233 3435 
80404311032296lbl42B004342ti66347»3> 

2 5 7670410020 0 1207149903138716134078 

1 6 7670410020 68l06449734ll56005i3305 

2 0 8850946346 22299725011380099903729 

431775326512159659701 930233919 1 2775 

005603343682551 

1 2 3 4 5 6 7 8 9 10 11 12 13 1415 1617 18 19 20 2122 2324 2526 2728 2930 3132 33 3435 
043766til472079822772393528114051 
36749 6315114228 84968493292314064848 
50630 6315114228 418677 930233919 5 8 2 2 7 
83344 75956425^ ^ 059500 793005663 47617 
25767041002071098626224482209649626 
203244348047880388 

Ve vUl assume arbitrarily that the additive for eol. 1 is this makes the 
first digit of Message "A” an 8p. The first digit of Message must also 
be an 8n, so the additive for eol. 4 is 2, vhleh makes the 4th digit of Mes- 
sage "A" a 0. This criss-cross process is continued, until the entire addi- 
tive is recovered. The recovery of the entire additive is possible here 
because the displacement interval of the tvo messages, 3» not a factor of 
or has no multiple in common vlth the period, 35* If the displacement inter- 
val had been, say, l4, the conmion factor (7) would have resulted in a closed 
chain of additives for cols. 1 , 8, 15, 22 , and 29; thus there uould be 7 
distinct chains in all. 

d. After the additive has been recovered in the foregoing problem. 
Message "A" is reduced to mo n oedphabetic terms; this is shown below, together 
with the recovered additive: 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 2324 25 26 27 28 2930 31 3233 34 35 

03427391861281064725079368544892506 

87087O2O29IOI5IO77O3O35OB4322555333 

22340750241820243424934870272342572 

13340750241887142724765857166721809 

27468703073441235000042022555111223 

40750241890034901255124765857120279 

071430435070741 

The presence of the dinoms 22 before and after the tripled diglts^^ in tvo 
portions of the message makes the assun^tlon of 2 as a row coordinate reason- 
able, and the four consecutive occurences of the digit 0 makes this also a 
likely row coordinate. When the IntezmedlPi^ plain text is partitioned 
according to this hypothesis, the message idedn text can be recovered easily. 



See footnote 3 on p. 191 of Military Cryptanalytics, Part I. 
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beginning vlth tbe vords TO COMMANDING OFFICSi... Itae mtrix is reconstructed 
as foUotfs: 

4813795602 

- T I II il II <1 I IBM 

0 BCDFGHJ K LM] 

2 Ipquvwxyz.#! 

e^. Ihe period of the Isolags In subpar. ^ above, was determined firan 
the occurrence of a long Internal polygrai^e repetition within each message. 
If this repetition had not been present, ve still could have factored the 
Isologs by superimposing them and subtracting the cipher of Message "A” from 
that of Message ”B”. Since the plain text of the two messages Is Identical, 
these differences will represent the difference between the key digits at an 
interval corresponding to the relative displacement of the Isologs; there- 
fore these differences will repeat at an Interval corresponding to the le n gth 
of the period . The beginnings of the messages and their differences cro 'shown 
in the following diagram: 



8 ll 4 o 51367 49631 51142 28649 ... 
28663 47839 25767 04 l 00 20012... 



14530 24974 570 



"B": 04378 8814.7 20798 22772 39352 

”A": 8 o 4 o 4 31105 22961 61428 004 



3992 

The differences repeat at an Interval of 35 digits, revealing the length of 
the period. Note that the sequence of these differences is Identical to the 
delta (or lateral differences) of the additive at an Interval of 3 (l»a., the 
displacement Interval of the two messages) • If we take the delta at an inter- 
val of 3 of the key shown In subpar. ^ we will obtain the stream 24974 ..., 
which Is the same as the differences Just derived above. If we had subtracted 



Message "B" fl*om Message 
of these differences. 



we would of course have obtained the 



f. Isologs Involving Identical matrices and coordinates, but having 
additive keys of different lengths and composition, are readily STisceptible 
to attack providing the additive lengths are relatively prime. As a demon- 
stration of this, let us suppose that ve have a pair of isologs, factoring 
to 15 and 16, respectively. Ihe first 80 digits of the message are shown 
in Figs. 121 a and b, below: 



Message "A" 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 

817386335105038 

014546483038102 

590848367260901 

129530475688364 

06474038 o 4 o 8227 



79775. 



Message "B" 

1 2 3 4 5 6 7 6 9 10 11 12 13 14 15 16 

1284249831193617 

0289572896314652 

6818771887016289 

3729961746862379 

6901268146067121. 



Figure 121 b. 
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If ve asstmie an arbitrary additive of / for the first coLunia of Message "A", 
ve get the decipherments shown in Fig. 122 &. These declphements are now 
cribbed into Message as shown in Flg.*~122b together with the derived 
additive; this latter is used to decipher more^dlgits in Message "B", and 
these declphements in turn are cribbed into Message "A", and so on until 

Message "A” 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 

1738633510503 b 

6 

0i45>^64-83038102 

0 

590848367260901 

129530475688364 

1 

064740380408227 

0 

7 9 7 7 5 

7 



Message "B" 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 

3 92107 

1264249^31193617 
8 0 
0289572896314652 

5 

6818771887016289 

1 

3729961746862379 

0 

6901268146067121 

7 



Figure 122b. 
14 “ 



Figure 122a. 

all the inteznedlate plain text has oeen recovered 



g,* nie foregoing situation is easily exploitable no natter what the 
lengths of the periods are, so long as they are prime to each other. If 
the lengths of the periods are not relatively prime, the general approach 
in the previous subparagraph may still be used, if not to reduce the text 
to monoalphabetic terns, at least to reduce the text to several sets of 
families which mi£^t then be amalgamated by other means. In passing, it 
might be pointed out that a difference of 1 in the lengths of additives of 
a pair of isologs mie^t arise ftom aa error in copying out the additive, 
resulting in an added or a dropped digit. 



£. In the next situation, ve will assume that ve have a pair of mes- 
sages factoring to 15 , having identical beginnings 20 digits long. The 
first 80 digits of these messages are given below; 



Message "A" 

1 2 3 45 6 7 8 9 10 11 12 13 14 15 

817386 33 ?10g038 
01454 1117517432 
370739530797395 
249940372533689 
760931854529952 
06169 

Figure 123a. 



Message "B" 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 
817386335105038 

01454 6 483038102 

590848367260901 

129530475688364 

06474038o4o8227 

7 9 7 7 5 

Figure 123 b. 



nie plain text and baac matrix in this example are the same as those given in the preceding subparagraph. 
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Let UB take the difference stream (designated as fbr the two messages 
at an interval corresponding to the period. If each rov is subtracted from 
the rov Inmedlately bexieath, we have the following: 



Message "A” 

1 2 3 4 5 6 7 8 9 10 U 12 13 14 15 
2072658824124o4 


, Message "B” 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 

2 0 7 2 60158933174 


36 6^ 98423280963 


58630^ 984232809 


979211842846394 


639792118428463 


321091582096373 


94>3210915820963 


30176 


73301 


Figure 124a. 


Figure 124b. 


She difference streams for the two messages, beginning with the 19 th digit 
of the ^ for Message "A" and the 21st digit of the A for Message "B", are 
identical. Ihis is clear proof that the 'two messages are isdogs;^ the 
messages start out with the same plain text enciphered with identical keys, 
and then evidently a 2-diglt etagger takes place. If we assume an arbitrary 
additive of 0 for column 1, we derive plaintext values which can be cribbed 
from one message to the other, and both messages can be reduced to monoalpha 



betlc terms, as in subpar. f, above. Sue cause of the error, after the inter* 
mediate plain text is solved, is discovered to be that, in Message "A", an 
Fp (*03) was left out of the vord OFFICER, thus producing a stagger situation 
at an offset of 2 digits. 

I. In the foregoing situation, the possibility’ that the two messages 
are liologs might have been indicated by their near -correspondence in length. 
Message "A" being -two digits shorter than Message ”B". But even if the texts 
of the two messages diverged completely after the 80 digits shown in Figs. 

123a and ^ the length of the exact correspondence of plain text would be 
regaled by the delta streams as shown in Figs. 124a and ^ and solution would 
still go on as before. This is one more demcnstratron of the value of stagger 
situations, once they are recognised and exploited. 

J. For the last example of an isolog situation, we will treat the ease 
where a cipher clerk incorrectly enciphered a message using the equation 

P - K ■ C (l.e., eorsespondlng to the deciphering equationj instead of the 
eorreet P ♦ K >0, and subsequently he sent the corrected version. 

(l) Let us examine the following pair of messages. (For the sake of 
lUuBtration, we will assxane the matrix to be known, and that it is the 
REEUBUC matrix of subpar. 86h.) 



^ If these messages had been very short, both ibev periods and Ae fact that they ate isologs could have 
been discovered by taking their individual difference streams at various intervals cotreqxmding to tnal periods; 
when a period of 15 was tried, we would have gotten Ae results as Aown above. 




If 
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77421 


29282 


51449 


98657 


Message 

94622 


"A" 

91878 


57896 


14694 


85074 


34064 


24606 


42952 


61890 


94115 


05362 


50380 


91241 


69655 


52623 


97711 


11685 


81828 


31247 


92253 


Message ”B” 
l4086 75038 


99034 


98098 


23472 


96842 


48022 


88U6 


29870 


74575 


67308 


96706 


95465 


47095 


96463 


73999 



AU the differences of the corresponding digits between the two messages are 
even, pointing to the type of error Involved. The length of the key is not 
known, nor can it be determined from the two messages at hand; nevertheless, 
solution of the plain text will proceed without knowing this length, and the 
additive will be recovered as the very last step in the process. 

(2) The first thing we will do is add the two cipher texts, as shown 
below; this has the effect of giving us 2P, or twice the vcd.ue of the plaln- 




Ci: 77l>ei 29282 ^1449 966^ 94622 918T& 57&96 14694 85074 3>i064 

C2: 11685 81828 ^47 <32253 l4066 75038 990^4 96096 23472 96842 

2P: 88006 00000 52686 80000 0h608 %806 46820 02632 08446 20806 

r 44003 00000 41343 40000 04304 33403 23410 01341 04223 io4o3 

^*199558 55555 96898 95555 59859 88958 78565 56896 59778 65958 




24606 42952 61890 94115 05362 
48022 88116 298TO 74575 67308 

30 6^0" 



62628 20068 



50380 91241 69655 52623 97711 
95465 47095 ^463 73999 
86^ 06^ 48086 



r 31314 10034 40330 34340 31330 
L 86869 65589 95885 89695 86885 



24 o 43 43303 03320 24043 30300 
79596 96858 58875 79598 85855 







text digit fov each position, vitiating the effect of the key. Next, this 
value of 2P is decomposed into the two possible plaintext digits it can repre- 
sent (for Instance, a 2P of 8 could arise from a4^4, ora9^9). Qien, 
knowing the matrix, it is a simple matter to recover the original plain text 
firom the double stream of Intermediate plaintext digits. The message text is 
recovered, beginning with the words BECQNIIAISSANCE FAHStOLS. Finally, the 
actual intermediate plain text is set against the cipher text of Message "B", 
and it is found that the additive is a 5lHllglt repeating sequence 

(3) If the matrix were not known, it still might be possible to analyze 
the double plaintext stream if a favorable crib began the message. In the 
previous example, the probable word RECONNAISSANCE will permit the identifica- 
tion of the two row coordinates (in variant form, of course) and the equiva- 
lents for the 8 letters; but unless there are enou^ different letters in the 



This sequence is the value of e, the base of natusal or Napierian logarithms, 2 . 71828 . . . . , taken to 50 
decimals. There have been cases in cryptographic practice when key digits have been obtained from mathe- 
matical tables (such as tables of logarithms, trigonomeDlc functions, etc. ), or have been derived from a 
fraction yielding a long repeating decimal, or have been generated by some mathematical formula, hi other 
cases, key has been derived from literal text by enciphering die latter widi the monome-dlnome rectaqgle, 
similar to the Nihilist method treated in the preceding diapter. 
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crib, it will be very difficult to recover the renalnder of the plain text 
from the several variant deelpheroenta for the rest of the cipher text.^'^ In 
any case, the rov- and c(d.unn coordinates cannot be determined uniquely, but 
may be recovered on a relative base because of the variant aspects Inherent 
In the solution. 



89. Additional remarks.- - a. In the examples In the preceding paragraphs, 
only one type of monome dinome matrix has been used; viz . , matrices vlth two 
rov coordinates. Of course, any type of monama-dlname matrix (such as one of 
those given In par. Military Cryntanalytlcs . Part l) might have been used 
for piroduelng the Intermediate text, but tills is iamaterlal insofar as the 
general msthods for reducing to monoalphabetlc terms are concerned. What does 
matter, as has already been remarked In siibpar. 8^ Is the theoretical I.C. 
of the Intermediate text produced by a specific matrix. Several eases will be 
cited In the subparagraphs following. 



b. The REPUBLIC matrix Illustrated In pars. 86 and 87 has an I.C. of 
1.62,'~caleulated from the expected frequencies of the digits given In sub- 
par 87b. The sum (N) of these frequencies Is 1^90; the po* vlilch Is 

(f(f-l). Is 410,098. Since the formula for the £ I.C. Is ^ where 

e Is the nuoiber of categories (in this ease, lO), the S I.C. Is 



10(410.0^ ) 

1590-1589 



1.62. 



e. The I.C. of a particular matrix depends not only on what letters 
constitute the monome rov, but also on the coopositlon and arrangement of 
tl^ letters In the dinome rows with respect to the letters In the monome 
rov. Thus, In the following two matrices. Fig. 129a has an I.C. of l.l4. 



8 

9 



123 

TTr 



4 5 6 7 8 



ETNROAIS 

BCDFGHJK 

PQUVWXYZ 






0123456769 
■IprorA 0 A 1 s 

BCDFGHJKLH 

PftUVWXYZ 



Figure 125a. 



Figure 125b. 



while Fig. 125b has an I.C. of I.I6. nie theoretical lover and upper limits 
of I.C.'s for matrices with two rov coordinates are 1.02 and 2.10; these are 
the I.C.'s of the matrices In Figs. 125c and d, respectively, given below: 





0123456789 




0123456789 


• 


E T K R 0 aTsH^ 






8 


Q B V G U P H L Zj| 


8 




9 


KXWYMFCD 1 


9 





Figure 125e. Figure 125d. 



This is similar to the process of solution of the Edgar Allen R>e cipher with variant plaintext values (cf. 
footnote 2 , subpar. 2^, except that in this case the process u considerably more complicated m its applica- 
tion to monome -dinome ciphers. 
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Where the monome row eonslate of a key word. It has been foimd that the 
Z.C.'e of such natrlees are usually in the '^clnlty of 1.30 to 1.30, for 
what this generalization of the range Bd^t be worth. 



d. Matrices with more than two row coordinates should be expected to 
hare hl£^r I.C.'s than matrices with only two row coordinates; howerer, in 
the matrix below, which has been manipulated to yield the lowest possible 
theoretical I.C., we get an l.C. of 1.00.^^ 



7 

8 

9 



0 12 3 4 5 6 
B T N R 0 A I 
B Q G U S L 
D J W H F P 
V Z S C Y X K 



Figure 125e. 

e. In subpar. 86b we noted that the l.C. of the 44o digits of the 
cl]^r text, when written out on a width of 20, yielded an l.C. of 1.22, 
remarking that this l.C. "seems surprisingly good for a reudom case, if 
it is random." We subsequently found out that the correct width for this 
cryptpgram was 30, so the reason for the "surprlsine^y good" I.C.^^ is now 
clear: on a width of 20 each column is actually composed not of an assort- 
ment of digits belonging to all possible families (and therefore possessing 
random character is tics) , but of digits belonging to only three of these 
families.^*’ If we had written out the cipher on a width of 15, we would 

If the expected value of the (1. C. for this matrix were calculated using the theoretical frequencies 
(seduced to 1000 letters) given in subpar. 87b. It would be found to be 0. 995, which is a mathematical 
absurdity since, by definition, the random l.C. is 1. 00 and rw samplug (with replacement) from a population 
could possibly have an expected I. C, of leu than 1. 00. The error present here is caused by discrepancies in 
rounding off to a base of 1000 the actual frequencies of an observed sample of 50, 000 letters. A uue picture 
of the estimated l.C. can be obtained by using a statistic known as the "gamma I.C. ”, derived by the formula 

y I. C. = • which turns out to be 1. 002 for this case. The difference between the S I. C. and the y I. C. 

approaches 0 as N grows large- -if the actual frequencies of die 50, 000 leners had been used, the S l.C. would 
have been identical to the y I.C. The % LC. suffices for most purposes, and Is in fact preferable in treating 
small samples, since it gives an unbiased estimate of the roughness, independent of sample size. 

The reader with a background In statistics will realize that the phrase "surprisingly good” is certainly an 

understatement, to say the least. It can be shown that die slgmage of this LC. Is 22-1^ 00) = 5 , i 

V2(20.9)* 

which may be translated as odds of 1 chance in 200, 000. (We use here the distribution for an evaluation 
of the slgmage, not the Normal /"Gaussian/ distribution, since it has been established diat the ^ estimate is 
closer to the true value dian is the Normal estimate. ) This certainly shows that causal facton are responsible 
for this I. C. : but m view of the explanation given, it also diows the student that he must use ciypiomathema- 
tics intelligently— not blindly Jump to conclusions when he gets a high score in a particular test. The L C. of 
1.22 is doubtlessly causal, but it is not the right answer. 

Since our distributions consist of the merger of ±ree separate families or distributions, the erqtected L C. 
(when the families are equlprobable) Is 1. 00 plus one-tfaird of the "bulge" between the L C. of random and the 
I. C. of the matrix, hi this case, the REPUBLIC manrix has a theoretical L C. of 1.62, theielbie on a width of 

20 the expected I.C. is 1.00 + = 1,21. 
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have obtained an l.C. of l*27j understandable alnee each eoLuina la nov com- 
posed of digits from only two famlllas Instead of digits from the total 
population of equlprobable fSalllea.^^ 

f. Tbo application to enciphered monome-dlname syatems of the delta- 
stream method^^ la g^lte posalblej but It Is usually leas likely to produce 
clear-cut exploitable results than In the case of enciphered dlnooe systems. 

Dlnone and split dlnoma counts night theoretically be useful In 
equating colunns In enciphered monone-dlnooe systems; howewery In actual 
practice If there la enough material to use these methods with confidence, 
there Is also usually enough material to equate colunns by means of mononle 
distributions. Nevertheless, In difficult cases the cryptanalyst might 
have no choice but to use these methods. 

h. Ihe higher the l.C. of the underlying monoms-dinoiBe matrix, the 
less msiterlal is generally necessary for the successful equating of columns. 
Ihus, In subpar. B6^ It Is possible to equate the eolumis of Message "A" 
without Message , but not without considerable trouble. 

1^. In systems employing matrices of very low I.C.'s (such as an l.C. 
of 1.02 for the matrix In Fig. 12^c), the monomle roughness Is not signif- 
icantly above random to permit the use of the aonomlc S l.C. In establishing 
the period or In equating columns. Nevertheless, the pronounced dlnomlc 
roughness Inherent In all monome-dlnone systems is enough to enable the 
factoring and subsequent equating of edumas, given sufficient material. 

It might not be amiss to observe that additive -enciphered dlnone 
systems employing a single -digit word separator will give rise to manifes- 
tations of an additive -enciphered nonone -dlnone system. The processes of 
factoring and equating of columns here will be pursued as In monone-dlnome 
systems, until the evidence of such a word-separator usage Is uncovered and 
exploited. 

k. Note that. In the two messages given In subpar. 86a et sec . . Message 
"B" begins at the very next position In the keying ^rcle where Massage "A" 
stopped. This phenomenon, known as tailing, can be used to "set" messages 
along the keying cycle without resort to adiaustlve trials to prove the cor- 
rect superlmposltlon, if It has been observed that traffic emanating from a 
particular originator exhibits a hi^ Incidence of this situation. 

l. This chapter has concerned Itself entirely with additive -enciphered 
monome-dlnone systems as Illustrations of the methods of attack on periodic 
encipherments of mixed-length Intermediate plaintext elements. It Is clear, 
however, that the general approaches treated apply equally well In those eases 
idiere tte Intermediate plain text is conposed of dlnomes and trinomes, or 
other similar variations of mixed-length systems. 



The expected I. C. in this case is 1. 00 -i- = 1. 3, as explained in footnote 20, above. 

Cf, subpai. 83j_. 
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ffl. The obseiratlons mada in subpar. 84b with respect to additive, sub- 
tractive, and nlnuend enelpbementa in the s^tese of the preceding chapter 
of course also apply to aonooe-dlnooe systems. 

n. As a final remark, it mi£^t be noted that situations vhereln the 
composition of the matrix is ktioim, but the coordinates are uzlknown, is not 
of Bueh help in attacking a cryptogram in the Initial stages, unless a crib 
is also available. As an example, let us consider the foUowlng crypto- 
gram, factoring to 35: 



1 2 3 4 5 8 7 8 9 10 U 12 13 14 15 18 17 18 19 20 21 2223 242526 2728 2930 31 32 3334 35 

80404311052296161428004342666347639 

2 5 7670410020 0120714990313B716134078 

1 6 7670410020 68106449734115600513305 

20885094834622299725011360099903729 

43177532651215965970193023391912775 

005603343682551 

It vUl be assumed that the eneoy has been using a matrix with internal 

I I II II II II I II BB 

B C D 7 0 E J K LM] 

PQUYWXYZ.#| 

Figure 126 . 

eamposition as shovn in Fig. 126, above, but that «e are faced with unknovn 
coordinates. It is further believ ed t hat the cryptogram begins vith the 
opening stereotype "10 C0MMABDIN6 OFFICER." 

( 1 ) It viU be noted that the plaintext letters of the crib C, M, D, 

6, and F must all come from, the same rov of the matrix; therefore the first 
digits of all these dinome equivalents must be identical. If ve arbitrarily 
assume this digit to be plaintext 0, ve derive the relative additive for the 
appropriate columns which ve use to decipher dovn the columns. Thus: 



QQ 

Even in simple monoalphabeuc substitution, a known plam component is of no assistance in the eaily 
stages; and in later stages is helpful only if the cipher component has been derived in some systemanc fashion. 
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12 3 4 5 6 7 8 9 1011 12 131415 16 171819 20 212223 2425 26 27 282930 31323334 35 

431 2 6203 

8o4o431105229^1^142600434-2^^^3'^7^39 

/ /O / /O /p / / /o / / /o / /o /o / /o III 

TO COM MARDINGOF 7 ICER 

2 5 76704 10020 01207149903138716134078 

3 7 0 4298 

1 6 7670410020 68106449734115600513305 
3 7 0 4 2 7 8 

20885094834622299725011380099903729 
473 4 3000 

43177532651215965970193023391912775 
721 0 0517 

005603343682551 
103 0 



We vlU fiuolly of the ** Jl" faally, for convenience. The 
dletrihutlon for the deelphenaenta of the A Ihally, excliullng the digits 
firom the original crib, is as follows: 



^12 

M- 

a 



3456769 

fiB- ?IB- 



(2) Since Tp and Gp cone firam the same column of the matrix, it is 
obvious that cols. 1 , 4 , and 25 l>elong to one fsinily; likewise, since Op 
fins Gp from the same column of the matrix, it is clear that cols. 2 , 

5 , 17, and I8 belong to one family, different from the two other families 
Just established. By examining the plaintext letters composing the original 
crib, ve will arrive at the following designation of families: 



T 


0 


C 


0 


N 


M 


A 


B 


D 


I 


H 


0 


0 


p 


P 


1 


c 


s 


R 




Y 




Y 




«L i 


£ 


1 




n 




* Y 


r 




•L0 


•n 




L 


B 



A total of 12 families Is possible, which may be collapsed eventually into 
10 families representing the equivalents for the 10 digits. 

(3) Since the r family is the heaviest family, next to dL , ve will 
take a distribution of the y family equated in terms of an arbitrary addi- 
tive 0 for cdl. 2, again excluding the elements derived from the assumed 
crib. This is as follows: 



012^45678 




•B- 
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We mil nov perform a cross-products sum test between the distribution for 
o( and all possible slides for ; this Is showm below: 



9335 IH- 6 M 



1 : 


1-513311-3 


53 


2 : 


-513311-31 


59 


3 * 


513311-31- 


99 


4: 


13311-31-5 


47 


5: 


3311-31-51 


68 


6 : 


311-31-513 


83 


V 


11-31-5133 


52 


8 : 


1-31-51331 


59 


9: 


-31-513311 


56 



It Is apparent that y Is at a slide of 3 with respect to o( ; tbe combined 
distribution for (e(. * S') Is therefore as follows: 

0123^56789 

jlpl- 

pl -« ■ 

■ 

(4) Tbe work sheet for tbe cryptogram vUl now look like this: 



1 2 3 4 5 6 7 8 9 10 11 12 13 14 IS 16 17 18 1920 21 22 232425 2627 28 2930 31 32 3334 35 



P X ^ ^ t * t ft- B d t. $ 

34731 2 64720 3 

6o4043 110 ^ 22961614 2b0043^266 
/7/0 /7/0 /O / / /o / / /o 7/7/0 /o / /o / / / 

TO COM MANDINGOF FICSR 
2 5 7670410020 0120714990313871 

23 Olf 0 ff 4342 9 8 






6 1 



TT 

3 



7839 

4078 



1 6 7670410020 68106449734115600513305 
33 ol' 0 S’ 4 2 7 2 7 8 



20885094834622299725011380099903729 
74873 4 35000 0 



43177532651215965970193023391912775 
07021 0 01251 7 



005603343682551 
71303 0 



At this point the 10-dlglt repetition In tiis second and third lines Is ex- 
amined. If tbe 07 Is a proper dlnome. It represents On; and the repetition 
Is Just the rlepit length for the assumption of RBBIMENT. (Furthermore there 
Is a hit with the cipher dlxiome 10 which Is an Np firom CCMMANDIBG. ) This gives 
us Bp ■ 3 y and Tp ■ 8 ; therefore Cp ■ 06 (cols. 4 and 25) > which yields^ in 
col. 4 , Sp ■ 4 . Substituting Ep ■ 4 in cols. 10 and 26, Tp ■ 8 In col. 1, and 
Bp ■ 3 in col. 27; we now get the following: 
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1 2 3 4 5 6 7 8 9 10 U 12 13 14 IS 16 17 18 19 2021 222324 25 2627 282930 31 32 3334 35 

034273 1 6 2 6472 0 3685 

B0i|>043110522961^l42b0043^2&66347639 

8/7/0 8/7/0 /o /9/ /o / / /o 7 / 7/0 /o / /o 8 / 4 / 3 / 

TO COM MANDINOO? FICER 

2 5 7670410020 0 I2071499O3I38716134078 

2 2/3/4/0 7 / /o /V /a/ 4342 9 8702 

REGIMENT 

1 6 76704 i 0020 6 8106449734115600513305 
1 3 / 3 /Vo 7 / /o / 4 / / 8 / 4272 7 8571 

REGIMENT 

20885094834622299725011380099903729 

274687 374 3500 0 0225 

43177532651215965970193023391912775 
407502 1 9 0 0125 1 7658 

005603343682551 
071430 3 0 0 



( 5 ) The eoordlnatea thiw far reconstructed are the following: 

48 379 0 

- II I ll n II III I 1 

0 BCDFGHJ K LMI 
PQUVWXYZ . #1 



We note that in eol. 7, the additive OBist he such as to derive values where 
lo and 4 e do not yield any of the plain digits already recovered, , 

0 3, 4, 7 , 8, or 9 j the oxily possible additive for the eolumi that meets 
».Ma requirement is 9, which makes ■ 2p and 4g • 5]^ The last two co- 
ordinate digits, 1 and 6 , are now quidkly determined from the context of 
friKf decipherments obtained thus far, so that the completed matrix is as 



follows: 



0 

2 



4813795602 
B T N R 0 TisSH 
BCDFGHJ K L M I 
PQUVWXYZ.#! 



The last 8 digits of the additive sequence and the remainder of the message 
plain text are easily recovered by extending the already derived plain text. 
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PERIODIC DIGRAFHIC SZSXafi 



Paragraph 
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Cryptography of typical periodic digraphlc 91 

Analysis of a first case 92 

Analysis of a second case 93 

Analysis of other types of periodic digraj^c systems........ 94 

Additional remarks. 95 



90« General. In tbe usual literal periodic polyalpbabetie systems , 
the plaintext units treated are single letters* It might occur to a cryp- 
tographer thatj since ordinary ^aonoali^hetl^ digraphlc substitution is 
in principle exponentially more difficult^ of solution than the usual mono- 
alphabetic substitution, it foUcwa that a polyalphabetie system shere the 
unit of substitution is a digraph viU give considerably more security than 
a polyalphabetie monographic substitution. This premise can be easily demon- 
strated in practice; a such larger vdlumB of text and a larger number of 
favorable elreumstaneea usually are prerequisites to the successful crypta- 
nalysis of polyali^betle digraphlc ciphers* Fortunately, such systems are 
rarely encountered; the cryptography of systems suitable for practical use 
has Inherent veaknesses vhlch cannot be avoided except at the expense of 
inordinate complications in the vork of the cipher clerks performing the 
encryption* In the next paragraph ue viU treat the cryptography of typical 
polyalphabetie digraphlc systems lAere the "alphabets"^ are used cyclically* 

91* Cryptograifliy of typical periodic digraphlc eystems*— a* The most 
eleamntary idea of a periodic digraphlc system is perhaps a schi^ incor- 
porating N unrelated digraphlc systems used in a cyclical fashion* For 
instance, four Independent 26x26 digraphlc tables mLc^t be drawn up; Thble 

I would be used to encipher the 1st, 5th, 9th..* plaintext digraphs. Table 

II would be used for the 2d, 6th, 10th*** plaintext digraphs, etc* Since, 
however, such a scheme is rather clumsy in operation, it ndLc^t occur to a 
cryptographer to use only one basic table and modify it so as to yield a 
polyalphabetie digraphlc substitution* This ml^t be accomplished throu^ 
the use of a table such as the one Illustrated in Fig* 127, below* This 
table, yielding pseudo-dlgraphlc^ encipherments, produces periodic encipher- 
ments of a period of 4 digraphs. The first letters of plaintext digraphs 
are enciphered monogra^ileally by means of the four alphabets at the side 
of the table; the second letters of digraphs are dlgraphically enciphered 

by the equivalents within the table proper, the particular encipherment being 



^ See subpat. 6^ Military Cryptanalytics, Part L 

^ Each "alphabet” contains 26^ elements bearing a one-to-one correspondence benveen plalntem and 
ciphertext units. Hence we can s^preclate the notions of "monoalphabetlcity" and "polyalphabeticlty” as 
applied to digraphic systems. 

^ Cf. sulq>at. 68a, Military Cryptanalytics. Part I. 
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A| 

B 

C 

D 

E 

P 

0 

H 

I 

J| 

K 

L 

Ml 

B 

0 

P 

Q1 

R 

8 

T 

U 

V 

If 

X 

II 
z 



4 

2 

I 
H 
0 
H 
0 
U 
A 
E R 
0 B 
U K 
A C 
R D 
B F 
K J 
C L 
D M 
P 
J 
L 
M X 
P T 



4 



P 

Q 

V 




gonrerned by the Identity of the first letter of the plaintext digraph. 

Oils sehese could be extended to Include more alphabets for the enel^her- 
isents of the first letters of digraphs; these alphabets night be slides of 
a basic sequence (as In the example above), or they night be R different, 
unrelated alphabets. 



b. Another aystea for polyalphabetlc dlgrai^e enclphenuBnt night 
Incorporate a 26x26 table such as that shown In Pig. 126; the coordinates 
In this ease are vrltten on strips vhleh nay be slid to any point of Juxta- 
position against a predetexnlned reference point (for exasq^, the cell 
In the upper left-hand comer) . Oie sane key vord or tvo different key 
vorda night be enployed to set the tvo coordinate strips for a periodic 
dlgraphle systea wlldi a United period; or the tvo strips nieht be moved 
one position at a tine, to yield what for all Intents and purposes Is a 
progressive alphabet dtgraphlc systea with a period of 26 digraphs. 
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Figure 126. 



c. Instead of 26x26 tables, snail natrices such as four-squares, 
two-sqiiares, or FlayfUirs ml^t be used as a basis for cryptographic treat- 
nent in periodic digraphic systens. Since these matrices do not innrolve 
coordinates (as do the large tables), periodicity of encipherment would 
have to be obtained either (l) by the use of II different, unrelated small 
matrices for the succession of N digraphs in the period, or (2) by some 
scheme for permuting or deriving additional matrices firom a basic matrix. 

In the two foUovlng subparagraphs there will be illustrated some typical 
means for deriving a multiplicity of matrices firom a basic matrix, using 
a 5x5 Playfair square for the examples. 



d. Let us assume that our basic Playfair matrix is that shown in 
Fig. below. We take the first four letters of the top row, BXBR, 

and we inscribe them on a diagonal to the ri^t of the Playlhlr square, 
as shown in Fig. 129b. In Fig. 129|e^ we complete these four skeletal 
colimms by permuting vertically the first four columns of the Playfair 
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•qioare, using the diagonally inscribed letters as reference points; this 
not yields a total of 5 nayfeir squares, starting in eadh of tbe first 3 



HYDRA 
U L 1 C B 
B F 0 K M 
H 0 F Q 8 
T Y W X Z 



1 

HYDR A 
U L 1 C B H 
S F G K M~Y 
H 0 P Q 8 ~D 
T V H X Z “R 



1 2 3 4 5 

HYDRATOOC 

ULICBHVPK 

ZFGKMUYVQ 

N0PQ8ELDX 

TVVXZHFZR 



Figure 12^. 



Figure 129b • 



Figure 129e . 



eoliams as shovn in tbe figure. The next four letters in the top row of 
our new diagram are A3X)G; we inscribe these letters diagonany to the right 
of the diagram, and peraute the coluims as before. After perfoming this 
process five times, we hare the diagram shown in Fig. 129;^ below, which 
would than start to repeat Itself. Iha reference numbers 1-20 axe inscribed 



U VH X Y Z 

ABCDBFGHIJKLMH0PQR8T 

1 23456789 10 11 12 1 3 1 4 IS 16 17 18 19 20 

dyDhAirOGCS^SYPRMTLdQZ H Y D R 

ULIGBHVPKAHLVCSHFPXAULIC 

IFGKHUYHQBTFDKZUOWRBBFGK 

H0PQ8BLDXMH0IQASYDCMH0PQ 

TVWXZHF1R8UTGXBHYIK8IVVX 

Figure 129d. 

orer the diagram, as well as the key letters A-Z (whldi could be used for 
indicator purposes) . This Playfair system actually consists, then, of a 
"band" composed of 20 interrelated Playfair sqjuaxes, which are denoted either 
by the nueber or a letter orer tbe upper left-hand comer of each square. 

Da using the FLayfeir band, a 5x5 cut-out mask (provided with an aperture 
to expose the particular square indicator) is slid along the bond according 
to a prearranged periodic key; or each square could be used sueceaBlrely to 
encipEwr the digraphs of tbe plain text, yielding a progreselve alphabet 
digraphic eystem of a period of 20. 



e. In the next scheme for deriring a plurality of Playfair equares, 
we will generate a band of 25 squares Iqr a method of permuting two columns 



1 




2 










1 








4. 








nr 


Y 


TT 


T 


A 


H 


F 


H 


Y 


t 


T 


X 


T 


T 


D 


u 


L 


I 


C 


B 


Y 


H 


U 


L 


1 


C 


B 


Y 


H 


R 


E 


F 


G 


K 


M 


U 


0 


E 


F 


G 


K 


N 


U 


0 


1 


H 


0 


P 


G 


8 


L 


T 


N 


0 


P 


Q 


8 


L 


T 


C 


Z 


V 


V 


X 


Z 


E 


V 


T 


V 


W 


X 


Z 


E 


V 


G 



K 

P 

Q 

H 

X 



Figure 130a. 



Figure 130b . 
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at a tin. We etort vlth our baele PlBarflalr eq]aare in Fig. 130|^ taking 
the first two letters of each rov (Hf, UL, BF, NO, and Tf) of tSe square, 
inscribing tbsm vertically to the rie^ of the square; this piroduees the 
second Flayfiair square. We nov take the square Just derived and, as 
shown in Fig. 130^ ve go through the sans process as before, the first 
two letters of each row in the second square being recorded in two columna 
to the right of the second square, yielding the third square. Ihls pro- 
cedure is continued for a total of 23 squarea, aa shown in Fig. 130c, 

1 234S6789 10 U12 13 

HXDRAHF0KAUFXKBUNIPB8NTFWSZTV 

ULICBYNRPHSDIAWFZKVUXISB6HMP0 

BFGKMUOZQBLNCPYSRTHWDZAVFXKSU 

NOPqSLTCWYZRVHXDBAOFMKOUQILBC 

IVWXZBVGXHEOGQHLOCQYLRCHYDRAH 

13 14 IS 16 17 18 19 20 21 22 23 24 25 (eheck}_ 

WSZTVWXZBVGXNBOGQMLOCQYLR CfH S\ 

GBMPOSQTLWCZYTRXHBDGAMFOKQIULI CBI 
FXKBUG1MB0NQPL8CTYWRZHVDXABFG KM{ 
Q1LBCNYPR8HTDWAZFVKXUBIGBMIN0P Q8I 
YBRAHFDKAUF1KBUNZPB8NTFW8Z[tVW_X^ 



Figure 130c . 

after which point the band will repeat Itself. (In Fig. 130c we have split 
the band into two sectlona for convenience, repeating the 13% square at 
the beginning of the second section to avoid errors.) 

f . Many other nethods for permuting a series of squares from, a basic 
square are of course possible; the particular system of generation will 
detemLne Just how nany derived squares will be produced, and how nany 
different enciphements of a given plaintext digraph will be available..^ 

£. In the foregoing system of 23 squares, there are xnsnerous possi- 
bilities that lend themselves to keying procedures. In one system, the 23 
squares ml^dit be used in cyclic order, beginning with any desired square;^ 

4 In the system described In subpai. d. e partlcitlai plaintext digraidi will have either 1, 6, or 8 different 
cipher equivalenu, ovring to the weak nature of die permutation used for deriving additional squares. However, 
in tbe system illustrated in subpar. e, them nrill be from 12 to 18 different equivalents for a digraph, %ritfa a mode 
of 13 occurrliig in dlghtly more than one-third of die cases. In other words, this latter system is a periodic di- 
graphic system of a period of 25, involving an equivalent of 12 to 18 different Playfair squares. 

9 The indicator procedure might consist of die numerical designation of die selected square used to start the 
encipherment; or, since it will be noticed diat each of die 25 letters occupies the upper left-hand corner of 
one particular square and one square only, a square may be designated by die letter occupyutg this position. 

Thus, square number 6 may also be designated as the "U" square. In an indicator such as AABUU, the first 
three letters ml^t designate a partlciilat niunerical key (such as the one derived from HYDRAULIC ANALOGIES 
in this subpatagra;di) from among a set of keys, dm last two letten dwwlng the starring pomt in die sequence. 
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this aaounts to a progressive alpha'bet dlgrai^e system of a period of 
23* la aaotber system, there might he used a 2^-element uumsrleal key 
derived fvca. a literal key, such as the numerical sequence given helow, 

S 10 15 20 25 

HYbRAULICANALOGlkSHYbRAl^L 
10 24 6 19 1 22 14 12 S 2 17 3 IS 18 9 13 8 21 11 25 7 20 4 23 16 

as a means of disarranging the normal 1, 2, progression of the 

Playfair squares In order to remove the czypt^aphlc veakness of three 
columns In comnon hetween the squares used to encrypt adjacent plaintext 
digraphs. For Instance, If the first plaintext digraph vere enciphered 
In square number 6 as a starting point, the succeeding digraphs would he 
enciphered In square nudbers 19 1 22 l4 12 ..... 23 l6 10 24 6, at which 
point the cycle repeats. Many other variations In the keying of this and 
other systems are possible. For example, In the system described In sub- 
par. e^ a selection of a small nuiriber of the sqiuares nd^t he made on the 
basis of a repeating key, such as the "0", "A", "N**, and squares 

to yield a period of or a 23-letter mixed sequence ml^t he used. Other 
modifications Involve aperiodic keying methods, which will he taken up In 
Military Cnrotanalrtlca . Part HI. 

92. Analysis of a first case.- - a. We will now consider a problem 
from the diagnostic stage to Its ultimte solution. The fbllowlng message 
Is to he examined: 



jm/rz 


ZUDV 


BMSUT 


HKGII 


mEBS 


CLQDJ 


RHZLO 


FCKDC 


QEBVX 


LCEJM 


REBKP 


TNPqU 


DJVRR 


VOUDZ 


KARRO 


EltfCL 


QROCZ 


EMPJP 


GUKVC 


OCLCK 


YNLL6 


worn 


PTDIR 


FTBDE 


LPqpK 


inJVKO 


ILQZD 


Gsm 


YCEQP 


ROFUC 


ITKCB 


BHYIR 


LMLOD 


VRLHT 


UPINRI 


TTFBG 


TSBFR 


FYTKO 


UUGXB 


EDVTH 


BXIVR 


KSLGG 


JBBFQ 


EHSqj 


DGNIA 


NICZC 


UUSCX 


GDFDU 


IVKUC 


KKHLP 


lEHqj 


TITBU 


IGEQi;. 


VGUZL 


EBTVR 


PTOFB 


WQBVY 


CUlQLi 


UQgBB 


TOOXT 


RVEJG 


9<Rro 


FBCEV 


FZRXG 


VADVK 


BCCOU 


YXSUT 


HKGII 


HSgHg 


CUBHD 


OOLCZ 


ZSUGJ 


BMMRT 


GFECE 


VKYHZ 


YPPRF 


RRJMI 


JXUBO 


XARVN 


LQPFI 


ouuqs 


RNTOK 


X3BPB 


OIZQF 


ZRKBK 


CVKTP 


OPXXQ 


ZTVMP 


GBGHX 


EBEMV 


qUHRL 


Mgr.wri 


JZqUB 


BYZDT 


MFCRN 


KMDOG 











The presence of several long repetitions at Intervals factorable by 8 leads 
us to believe that we have here a periodic system of 8 alphabets. The mes- 
sage Is transcribed accordingly and unlliteral distributions are taken on 
the columns, as shown below: 
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OVLTZSLJ 

YLOFCKDC 

RVOUOZNA 

CLCKYRLL 

KOLLQYDG 

LMLGOVDL 

GXBEDVTH 

AHICZCUU 

ITBUIGEQ 

KLUQSRBT 

VADVKHCC 

LCZZSUCJ 

WJXWSOXA 

IZOFZRKH 

MWQUWRLM 



D V B M S U T H 
OEBVYLCE 
RROEIWCL 
GWOVTMPT 
BYXWYCEQ 
MTUFRRIT 
BXIVRKSL 
SCXGDFUU 
LVGUZLEB 
OUXTRVEJ 
0 U Y X S U T H 
B M M R T G P E 
RVRLQDFI 
KCVKTPOP 
ELBUJXQU 



KGIITMEB 
JMRPRKPT 
OROCZEMP 
DIRFTSDE 
OROFUCIT 
TFBGTGBF 
GGJBBFQB 
IVNLKNKH 
TVRPTGPB 
C Q M R T G P E 
KGIITMEB 
C E V K Y H Z Y 
OUUQSRRT 
Y X Q Z T V M P 
BSXYDTMP 



S C L Q D J N H 
KPQUDJVR 
JPGUMVCO 
LPQPKUUV 
KCBBMYIR 
RPYTKOUU 
HGQUDGNI 
LPIEMQUT 
WQBVYCLJ 
C E V P Z R X G 
S C U H M D 0 G 
PPRPBRJM 
WKXTRPBD 
C R G H X E B F 
C R U K M D 0 G 



a a.^^a.^. Sa. _a - 

1. AbCDEFGKIJKLHSOPQRSTUVWXYZ 



- P S-i SE__p=p_==p=H__ 

2. ABCDEFGHIJKLMNOPQRSTUVWXYZ 



3. 



a p_ a«Bp pa 

ABCDEFGHIJKLMNOPQRS 



aa p-_ 

T U V W X Y Z 



4. ABCDEFGH 



= = 9a- P a = 5PP = -- 

HIJKLMNOPQRSTUVWXY 



B C f 



P- 



-P 



5 . ABCDEFGHIJKLMNOPQ 



ff?uvwxf? 



6. A B 



9aaap« at a B a a s a - p b: - 9 9 

CDEFGHIJKLMNOPQRSTUVWXYZ 



7, ABCDSFGHIJKLMfofqRSTfvtfXYZ 



8 



Bp.-BB9p.e 9« -9 b. p9- 

. A B C D E F G H I J K L M M 0 P Q R S T U V 



V W X Y Z 



GOIIFIDBWTIA JL. 
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b. The I.C.'s of the distributions (conq^lslng 60 tallies each) and 
the observed nunber of blanks ( ^ ) for each are tabulated in the diagram 
below: 



Alph. 
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I.C. 


Alph. 


A 


I.C. 
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1.29 
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2.07 
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3 


1.29 


6 
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1.07 


3 


9 


1.66 


7 


6 


1.25 


4 


6 


1.32 


8 


6 


1.31 



Sxcept for alphabets 3 and the I.C.'s are fhr from satisfactory; the 
period Is unquestionably 8, but It does not appear that ve have 8 nonoalpha- 
betlc distributions. The average of the I.C.'s Is • 1.4l, a figure 

considerably above random but nevertheless not nearly close enou^ to the 
expected I.C. of plain text for a sample of text this size. We note, how- 
ever, that the average I.C. of the odd columns is 6.^ . 1.57, while the 

average I.C. of the even columns Is ■ 1.23; this strikes us as being 

expeclally significant.^ Furthermore, the average A for the odd coliunns 
is ^ « 7,$f while that of the even columns is ^ - 4.3; these figures are 

compared with the expected of 8 and the of 2.3 for distributions 
of this slze.^ Perhaps the odd columns do represent monoalphabetlc encipher- 
ment of plain text after all, while the even columns have undergone different 
cryptographic treatment. We will pursue this matter further. 

c. One of the possibilities that comes to mind to explain the fore- 
golng~phenomBna Is a pseudo -dlgraphlc encipherment In which the initial 
letters of plaintext pairs are raonographl cally enciphered. If this were 
the ease the dlgraphlc I.C.'s of colvomis 1*^, 3-4, 3-6, and J-B should be 
close to the expected~4.66 for English plain text;? these dlgraphlc I.C.'s 
are 3*38) 7*31^ 7*31« and 8.09, irespectlvely, giving statistical credence 
to the hypothesis that the four pairs of adjacent colinons represent di- 
graphically enciphered plain text.^ 

® It can be ;hown that the I.C. of the odd columns, 1.57, repiesentt a sigraage of = = 

^ 2 ( 25 - 4 ) 

8.3 a- , whereas the I.C. of the even columns, 1.25, represents a deviation of = 

V2(25'4) 

2.9 O' above random. (We used 1.08 in die fonnula instead of 1.00, because the former figure is the I. C. 
of the over- all cipher text. ) 

Cf Chart 6 on p. 39 of Military Cryptanalytlcs, Part 1. 

®Cf, subpar. 67c, Military Cryptanalytlcs, Part 1. 

g 

See also subpar. 95a_ for further lines of attack on this problem if die digtaptaic I. C. 's of the pairs of 
adjacent columns had not been satisfactory. 
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d. The l4-letter repetition in the nesBage is nov exanlned. The 
unlliteral firequeneles of the first letters of the cipher digraphs lend 
support to the assumption that this repetition represents the encipher- 
ment of RBCQNNAlSSAHCEf giving us the equivalents of Cp and Up in column 
1, Ap in col« Rp and Sp in col. and Ap and Cp in col. 7« in addition 

to tM 7 values vlthln the large square of the ^construction matrix. The 
third letter of the repetition BIR TG FB CE thus turns out to be Sp; fre- 
quency considerations of the first letters of these cipher digraphs make 
it quite likely that this repetition represents POSITION, which gives us 
additional values in our reconstruction matrix. Finally, the six digraphs 
at the beginning of the message Just before BBCONNAISSANCE are studied, 
and, Acorn the standpoint of the length of the ciphertext passage, plus the 
AB — — — AB Idiomorph exhibited, plus a consideration of the unlliteral 
ftrequencles of the initial letters of the digraphs, the opening word is 
assumad to be FBOTOGyRAFBIC. The values from these three plaintext assump- 
tions are set forth in the reconstruction matrix in Fig. 131^ below: 
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e. Bvldence of vertical direct symoetry, as veil as of diagonals of 
repeated letters characteristic of Vigenere>type squares, are manifested 
vlthin the matrix, as shovn by the lines in the foregoing figure; from 
these characteristics It appears that both the 0^ and ^ sequences of this 
dlgraphlc matrix consist of the normal A-Z sequence. If this is so, then 
direct symmetry should also be manifested among the four cipher sequences 
used to encipher the first letters of digraphs. Taking advantage of the 
principles of direct symmetry of position, the matrix In Fig. 131a Is 
amplified Into that shown in Fig. 131^ below: ~ 
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Figure 131h. 

The frequencies of the additional values placed by direct symmetry In the 
four monographic columns are checked, and they are found to correspond 
generally with the expected frequencies of their plaintext equivalents; 
this, then. Is conflnnation of the type of matrix assumed. 
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f. From the partially reconstructed matrix In Fig. 131^ above, the 
derived values may be entered on the vork sheet, as foUovs: 
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S3 


OH 


ES 


0 


TO 






DE 


D 


IS 


SI 


L 






C 




GX 


BE 


DV 


TH 


BX 


IV 


RK 


SL 


GG 


JB 


BF 


QB 


MG 


QU 


DG 


NI 




IT 


ES 


CO 


H 












B 








EH 




AN 


IC 


ZC 


uu 


SC 


XG 


DF 


UU 


IV 


NL 


KN 


KH 


LP 


IE 


MQ 


UT 




AG 


OS 








E 




ES 




C 


ME 


S 


AB 


I 




IT 


BU 


IG 


EQ 


LV 


GU 


ZL 


EB 


TV 


RP 


TG 


PB 


HQ 


BV 


YC 


LJ 


ED 


IN 


TH 


A 


SE 




0 


AN 


DT 




SI 


TU 




10 




RA 


KL 


UQ 


SR 


NT 


OU 


XT 


RV 


EJ 


CQ 


MR 


TG 


PE 


CE 


VP 


ZR 


XG 


N 




BM 










AR 


0 


PO 


SI 


TI 


ON 




OP 




VA 


DV 


KH 


CC 


OU 


YX 


SU 


TH 


KG 


II 


TM 


EB 


SC 


UH 


HD 


OG 




LL 


CO 


NT 






RE 


CO 


NN 


AI 


SS 


AN 






I 




LC 


ZZ 


SU 


CJ 


BM 


MR 


TG 


PE 


CE 


VK 


YH 


ZY 


PP 


BP 


BR 


JH 


SO 




RE 


NE 


MY 


PO 


SI 


TI 


ON 






Y 


U 








WJ 


XW 


SO 


XA 


RV 


NL 


QD 


FI 


OU 


UQ 


SR 


NT 


UK 


XT 


RP 


BD 






R 
















BM 










L 


IZ 


OF 


ZR 


KH 


KC 


VK 


TP 


OP 


YX 


QZ 


TV 


HP 


CR 


GH 


XE 


BF 


E 




OP 


ME 


NT 




S 








SE 


S 


OP 






L 




QM 


WR 


IM 


EL 


BU 


JX 


(V 


BS 


XY 


DT 


MP 


CR 


NK 


MD 


OG 


T 






RT 


B 


IN 






MI 




ED 


S 


OP 




I 





From here on the addition of further values will snowball, and In very short 
order the plain text Is solved In Its entirety, and the encl{flierlng matrix 
completed; the latter Is found to be Identical vlth the matrix Illustrated 
In Fig. 127. 
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The steps In the solution of the foregoing problem were simple. 
The diagnosis of the system was stral^tforward, and the reconstruction 
of the plain text and of the matrix was begun by three word assumptions. 

In actual practice , the solution of a single message may not be so fortu- 
nate, but, as usual, we have shown the theoretical steps involving a 
single message which haa been manipulated to make possible a solution on 
this limited traffic; in operational practice, several messages would 
probably have been required in order to find the two or three cribs neces- 
sary for solution. If the o|| and sequences had been unknown mixed 
components, then the phenomena of indirect symmetry would have prevailed, 
and additional plaintext assumptions in the message would probably have 
been necessary in order to exploit the symmetrical phenomena in such a 
case. 



h. A few remarks on the I.C.'s given in subpar. b might be added at 
this time. Alfdiabets 1 and 7 were a trifle low, and the average l.C. of 
l.$7 for the o^ columns was eCLso lower than we would have liked to have 
seen for monoalphabetlc text. The vagaries of the plain text as it was 
allocated into the columns were responsible for this, since the over -all 
l.C. of the plaintext message may be found to be 1.7^> On the other hand, 
the average l.C. of the even columns should have been lower than the ob- 
served 1.25,^° but again this is "one of those things." The prudent 
cryptanalyst is prudent in his reverence for probabilities, small or large. 



93. Analysis of a second case.— a. For our next example we will 
assume that the enen^ is known to be using a system involving a multiplici- 
ty of Playfair squares to accomplish a polyal^diabetlc dlgraphlc substitu- 
tion. The following are the beginnings of 4o messages available for study: 





1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


1. 


IG 


WH 


CM 


TO 


SM 


WT 


UC 


ET 


RA 


LN, 


2. 


HK 


Hff 


YG 


RT 


HZ 


EF 


YO 


m 


IM 


CV, 


3. 


HK 


Cl 


KT 


IG 


OE 


QL 


FC 


HX 


PI 


FP, 


A. 


BS 


UO 


BO 


CO 


FR 


BF 


EK 


zo 


AB 


UV, 


5. 




IB 


VY 


CH 


IH 


FG 


ZN 


ZD 


ZO 




6. 


OV 


KH 


LF 


RC 


GT 


TO 


HZ 


RG 


HI 


YV, 


7. 


HZ 


SF 


WD 


CQ 


QH 


YU 


VO 


PI 


CA 


Al, 


8. 


HK 


wr 


PG 


IC 


CO 


DG 


RM 


HS 


EA 


XD, 


9. 


HA 


PK 


WE 


ZU 


VZ 


NG 


IR 


oz 


HT 


OE, 


10. 


HM 


IF 


HK 


BC 


CT 


FR 


FQ 


EO 


PI 


MO, 



The expected I. C. for the second letters of digraphs of English text enciphered In a pseudo -digraphic 
system Is 26(. 0667)2 = 1.16, as compared wldi the usual LC. of 26(.0537) = 1.73. This LC. of 1.16 u 
charactenstic of plaintext autokey systems (cf. Appendix 6, "Cryptographic Supplement") which will be 
taken up in Military Cryptanalyncs, Part lEL 

C O W IDBWTIAL - 















326 






REF ID : A64554 



u. 


HK 


LK 


ZL 


YP 


VD 


UC 


QD 


TS 


AB 


12. 


NT 


ZU 


NB 


PY 


OF 


ZL 


BG 


IR 


PI 


13. 


UN 


FZ 


BH 


NC 


UC 


ZU 


CS 


IX 


DZ 


Ik. 


QP 


PB 


CO 


TO 


DE 


uo 


ZO 


HX 


TB 


15. 


IG 


WN 


CM 


TO 


NG 


BM 


V 


US 


NQ 


16. 


HK 


IX 


Cl 


MU 


VD 


UC 


OD 


_TB 


BX 


17. 


HU 


CD 


AR 


FY 


HI 


CU 


HZ 


UT 


EL 


H 

GO 

• 


OV 


KH 


LF 


SG 


IT 


SO 


IZ 


KB 


SD 


19. 


UK 


FZ 


BU 


DY 


TA 


LO 


LI 


UZ 


NT 


20. 


HR 


ZF 


RT 


VZ 


FR 


MS 


RQ 


TO 


AK 


21. 


HR 


IG 


CO 


TO 


UB 


ZO 


KI 


ZL 


TO 


22. 


ID 


VY 


MC 


RC 


GT 


TU 


NZ 


QC 


LD 


23. 


LQ 


CSI 


LV 


HD 


PG 


AH 


PI 


BO 


BV 


24. 


HK 


NK 


PV 


HP 


UT 


DM 


IR 


GN 


CA 


25. 


FS 


W 


NU 


D6 


ZO 


IT 


OX 


IR 


RC 


26. 


QD 


BP 


TO 


GS 


TL 


PH 


PI 


SO 


TS 


27. 


LV 


KH 


YG 


DC 


SO 


CD 


TB 


MD 


CM 


28. 


FS 


HV 


UZ 


OV 


FD 


QL 


XO 


SB 


IP 


29. 


UP 


NT 


BI 


PY 


FG 


RO 


HZ 


QT 


PI 


30. 


HZ 


SF 


vro 


NQ 


DP 


NQ 


ZO 


LF 


IR 


31. 


HU 


HX 


XY 


BU 


LO 


WZ 


PD 


CR 


RL 


32. 


HK 


PG 


UZ 


OV 


UB 


ZQ 


FH 


LF 


ST 


33. 


NT 


ZU 


BH 


HC 


UC 


ZU 


CS 


KU 


SO 


34. 


AH 


IG 


IT 


BV 


EA 


VF 


PT 


AK 


NZ 


35. 


NM 


WV 


OV 


SP 


OX 


BG 


OZ 


YK 


SC 



Cl... 

XV... 

cz. . . 

NS. • . 
NP... 
SV... 
US. . . 
SI«. . a 

AT... 

KT... 

XO... 

OD... 

sx... 

CK... 
TI... 
SR. • • 
HX... 
EN... 
OP... 
XR... 
ZB. . . 
SA.. . 
TC... 

ZUa a . 
RC. a • 
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36. 


BR 


IB 


HE 


AM 


BU 


DA 


OX 


YD 


IM 


OV. 


37 . 


HK 


TG 


lie 


VS 


OE 


XB 


GE 


XO 


OZ 


FN. 


38. 


GL 


WV 


YG 


DC 


EO 


CD 


RL 


ZD 


zo 


FL. 


39. 


GL 


AQ 


SN 


FY 


HI 


CU 


KZ 


LC 


KP 


PK. 


1»0. 


LQ 


KZ 


uo 


RO 


BI 


CT 


NZ 


KB 


HH 


IX. 



From the repetitive ptaenooexia observed. It Is concluded that the nessages 
are In flush depth; l.e., each column represents a dlgraphlc "nonoalfto- 
bet". 



b. Abridged dlgraphlc distributions are new oade for the first few 
dlgraphlc columns; these are shown below: 



1. ABCDEFGH 

rs 



T 

8 



1 J K L M N 

IT 



T 

Q 

V 

Q 



0 

TT 



R 8 



T U V W X Y Z 

FS 



T V 

T 

M 



2. ABCDEFGHIJKLMMOPQRSTUVWXYZ 



Q P I 


Z V B 


H K 


K Y N 




F G 0 Y N U 


D 


Z V F 


H K 


T B 




F 




N F 




X G 


H 


G 








V U 




G 


Z 










V 




B 












V 
















V 


ABCDEFGHI 


J K L M K 0 P 




S 


T U V W X Y Z 


R H M 


K T 


F C 


T V G 


0 H 


0 Z Y D Y G L 


U 0 


E 


F 


B V 


T 




Z 


E G 


I M 




V 


U 






0 


D G 


H I 






C 











-flGHFTnffNTTflT. 



328 



REF ID:A64554 



^FIDEMTIAL 



k, ABCDEFGHIJK L MNP PQRSTUVWXYZ 



M U 0 Y 


Y S D G 


U C V 


T G 0 


Z F U 


V N S 


Y F C 


Q V 


C P 0 


8 


Q C 


Y 


C 


C 0 




C 


Y 




C 0 
0 




ABCDEFGHIJKLMN0PQR5TU 


V W X Y Z 



UOEORTIH 
ITPARTIT 
0 D 
G 



0 Z G E G E 
F 
X 
E 



M A C Z 
L B D 
T 0 
B 
C 



Rote Is taken of the high frequency digraphs In the columns, and also of 
the reversible dlgraidis. What follows now is a brief synopsis of the 
initial entries Into the problem. In col. 1, HKe, with 8 occurrences, is 
In all probability REp. Next, ve study the tetragraphic repetition CO TO 
in Msg flh and 21, and the repetition IG WR CM TO In #1 and 1^; It is 
assumed that these represent XI ON and DI VI 81 (W, respectively. Msg 
#32 Is now assumed to begin with the word RE GI ME HT. which would make 
MO VE ME RT In #28. In #38, ve have GL WV > FI Vk; In #27 ve have LV KH 
« YO UR and In #6 ve have OV KH If ■ FO UR TH. The 8-letter repetition 
between #6 and #22 Is assumed to be Dl VI SI OR; Msg #2 now appears to 
begin with the word RE FE RE NC E, which makes #8 RE FE RX R1 NG TO. IRie 
initial word in #22 is assumed to be WH EN, and In #3, RE IN FO RC EM EN TS. 



c. At this point the work sheet with the assumptions entered will 
now look as follows: 



1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


1. IG 


WN 


CM 


TO 


SM 


WT 


UC 


ET 


RA 


Ui. 


DI 


VI 


SI 


ON 














2. HK 


HV 


YG 


RT 


1C 


EF 


YO 


DR 


IM 


OV. 


RE 


FE 


RE 


NC 


£ 












3. HK 


Cl 


NT 


IG 


OE 


QL 


FC 


RX 


PI 


FP. 


BE 


IN 


FO 


RC 


EM 


EH 


TS 








4. BS 


UO 


RO 


CO 


FR 


DF 


EN 


zo 


AB 


UV. 


5. LQ 


IB 


VY 


CR 


IE 


FG 


ZR 


ZD 


ZO 


FL. 



NO 



6. 


OV 


KH 


If 


RC 


GT 


TU 


RZ 


RG 


MX 


YV, 




FO 


UR 


TH 


DI 


VI 


61 


ON 








7. 


HZ 


SF 


WD 


CQ 


OR 


YU 


VO 


PI 


CA 


AI. 


8. 


HK 


HV 


FG 


IC 


CO 


DG 


RM 


N8 


EA 


XD. 




BE 


IS 


RX 


RI 


NG 


TO 










9. 


HA 


PN 


WE 


ZU 


VZ 


NG 


IR 


OZ 


HI 


OE. 


10. 


RM 


IF 


HK 


RC 


CT 


FR 


FQ 


EO 


PI 


MS, 



DI 
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U. HK 


LK 


ZL 


YF 


VD 


UC 


QD 


JDS 


AB 


Cl... 


RE 




















12. NT_ 


ZU 


NB 


FY 


OF 


ZL 


RG 


IR 


PI 


XV... 


13 . UN. 


FZ 


3H 


NC 


UC 


ZU 


CS 


IX 


DZ 


cz. . . 


lU. QP 


PB 


CO 


TO 


DB 


UO 


ZO 


BX 


TE 


NE... 






TI 


ON 














13 . IG 


WN 


CM 


TO 


NG 


BM 


Of 


UE 


NQ 


NP... 


DI 


VI 


SI 


ON 














16. HK 


IK 


Cl 


MU 


VD 


UC 


OD 


IS 


BX 


sv... 


BE 




















17 . HU 


CD 


AR 


FY 


HI 


cu 


NZ 


UT 


EL 


UE. . . 














ON 








18. OV 


KH 


LF 


SO 


IT 


EO 


IZ 


KB 


SD 


SL. . . 


FO 


UR 




RE 


GI 


ME 


NT 








19 . UN^ 


FZ 


BU 


DY 


TA 


LO 


LI 


UZ 


NT 


AT... 












NE 










20. HR 


ZF 


RT 


VZ 


FR 


MS 


RQ 


TO 


AK 


KT... 


21. HR 


16 


CO 


TO 


UB 


ZO 


KI 


ZL 


TO 


XO... 






TI 


ON 














22. TD 


VY 


MC 


RC 


6T 


TU 


NZ 


QC 


LD 


OD... 


WH 


EN 


IS 


5T 


VI 


SI 


ON 








23 . LQ 


07 


LV 


HD 


PG 


AW 


PI 


EO 


BV 


sx... 


2k, HK 


NK 


PV 


HF 


UT 


DW 


IR 


GN 


CA 


CK... 


RE 




















23 . FS 


WV 


NU 


D6 


ZO 


IT 


OX 


IR 


RC 


TI... 


MO 


"W 


















26. QD 


BP 


TO 


GS 


TL 


PH 


PI 


EO 


TS 


SR. . . 








£R 














27 . LV 


KH 


YG 


DC 


BO 


CD 


TB 


MD 


CM 


HX... 


YO 


UR 




GI 


"mS" 


NT 










26. ES 


WV 


uz 


OV 


FD 


OL 


XO 


SB 


IP 


PN... 


HO 


VE 


Se" 


NT 




EN 










29 . UP 


NT 


BI 


FY 


FG 


RO 


HZ 


or 


PI 


OP... 


30 . ^ 


SF 


WD 


NQ 


DP 


NQ 


ZO 


u 


IR 


XR... 


31 . HU 


HX 


XY 


BU 


LO 


WZ 


PD 


CR 


RL 


ZB. . . 


32 . HK 


PG 


UZ 


OV 


UB 


ZQ 


FH 


LP 


ET 


SA... 


RE 


61 


ME 


NT 














33 . NT_ 


ZU 


BH 


NC 


UC 


ZU 


CS 


KU 


EO 


TO... 


34 . AH 


IG 


IT 


BV 


EA 


VF 


PT 


AK 


NZ 


ZU... 


35 . NM 


WV 


OV 


SP 


OX 


BG 


OZ 


YK 


SC 


RC. . . 



VE 
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36. 


BR 


IB 


HE 


AM 


BU 


DA 


OX 


YD 


IM 


OV. 


37. 


BK 


TG 


NC 


VS 


OE 


ZB 


GE 


XO 


OZ 


FN. 




RE 








EM 












38. 


GL 


WV 


YG 


DC 


EO 


CD 


RL 


ZD 


ZO 






FI 


VE 


rI“ 


GI 


ME 


NT 


S 








39. 


GL 


AQ 


6N 


FY 


HI 


CU 


NZ 


I£ 


KP 


PK, 




FI 












ON 








4o. 


LQ 


KZ 


UO 


RO 


BI 


CT 


NZ 


KB 


m 


IX. 



ON 



In the course of experimenting with the partial reconstruction of the 
Playfair squares for each column, we are able to determine that, in col. 
4, COc ■ Tip, CNc ■ IBp, NGc ■ RTp> D6c * *^p, VSe ■ ENp, and ROc ■ Nip 
These recoveries facilitate further assumptions, and in reasonably shor 
order we would have our work sheet looking like this: 





1 


2 


3 


4 


5 


6 


7 


8 


9 


10 


1. 


IG 


WN 


CM 


TO 


SM 


WT 


IK 


ET 


RA 


IK... 




DI 


VI 


SI 


ON 














2. 


HK 


HV 


YG 


RT 


MZ 


EF 


YO 


DR 


IM 


OV... 




RE 


FE 


RE 


NC 


E 












3. 


BK 


Cl 


NT 


IG 


OE 


OL 


FC 


NX 


PI 


FP... 




RE 


IN 


FO 


RC 


m 


EN 


TS 








4. 


BS 


UO 


RO 


CO 


FR 


DP 


£N 


ZO 


AB 


UV... 










TI 














5. 


LQ 


IB 


VY 


CN 


IH 


FG 


ZN 


ZD 


ZO 


mSS? . . 










TR 






NO 








6. 


OV 


KH 


LF 


RC 


GT 


TU 


NZ 


RG 


MT 


YV... 




FO 


"IS" 




DI 


VI 


"5T" 


ON 








7. 


HZ 


SF 


WD 


CQ 


QE 


YU 


VO 


PI 


CA 


AI... 


8. 


HK 


HV 


PG 


IC 


CO 


DO 


RM 


NS 


EA 


ZD... 




RE 


FE 


HZ 


RI 


NG 


TO 










9. 


HA 


PN 


WE 


ZU 


VZ 


NG 


IR 


OZ 


HT 


OE. . . 


10. 


NM 


IF 


HK 


RC 


CT 


FR 


FQ 


EO 


PI 


MG... 




SE 


ND 


AD 


DI 


TI 


ON 


AL 








11. 


HK 


IK 


ZL 


YF 


VD 


UC 


OD 


TS 


AB 


Cl... 




RE 


QJ 


ES 


TA 


RT 


IL 


1S~ 


RY 






12. 


NT 


zu 


NB 


FY 


OF 


ZL 


RG 


IR 


PI 


XV... 


SF 


m 


YP 


AT 


RO 


L 










13. 


UN 


FZ 


BH 


NC 


UC 


ZU 


CS 


IX 


DZ 


cz. . . 


HE 


AV 


YA 


RT 


IL 


I£ 


RY 








l4. 


qp 


PB 


CO 


TO 


DE 


UO 


ZO 


BX 


TE 


NE. . . 


PO 


SI 


TI 


ON 














15. 


IG 


WN 


CM 


TO 


NG 


BM 


V 


UE 


NQ 


NP... 


DI 


VI 


SI 


ON 
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16 . 


HK 


UC 


Cl 


MU 


VD 


UC 


OD 


TS 


£X 


SV. 






BE 


QU 


IR 


EA 


RT 


IL 


UB 


RY 








17. 


HU 


CD 


AR 


FY 


HI 


CU 


NZ 


UT 


EL 


UE. 




TH 


IB 


DB 


AT 


TA 


LI 


ON 










18 . 


OV 


KH 


LF 


SG 


IT 


EO 


IZ 


KB 


SD 


SL. 






PO 


UR 


TH 


RE 


GI 


HE 


NT 










19. 


UN 


FZ 


BU 


DY 


TA 


LO 


LI 


UZ 


NT 


AT. 




HE 


AV 


Y 






NE 












to 

0 

. 


HR 


ZF 


RT 


VZ 


FR 


MS 


RQ 


TU 


AK 


KT. 






AD 


VA 


NC 


E 
















21 . 


HR 


IG 


CO 


TO 


UB 


ZO 


KI 


ZL 


TO 


XO. 






AD 


DI 


T 1 




AL 














22 . 


XD 


VY 


NC 


RC 


GT 


TU 


NZ 


QC 


LD 


OD. 






WH 


SN 


IS 


DI 


VI 


SI 


ON 










23* 


LQ 


OY 


LV 


HD 


PG 


AW 


PI 


EO 


BV 


sx. 




24 . 


HK 


NK 


PV 


HF 


UT 


DW 


IR 


GN 


CA 


CK. 






RE 


CO 


NX 


NA 


IS 


SA 


NC 


E 








25. 


PS 


wv 


NU 


DS 


ZO 


IT 


OX 


IR 


RC 


TI. 




MO 


“W 


YO 


UR 
















26. 


QD 


BP 


TO 


GS 


XL 


PH 


PI 


EO 


TS 


SR. 






FR 


IS 


ON 


ER 
















27. 


LV 


KH 


YG 


DC 


£0 


CD 


TB 


MD 


CH 


HX. 




YO 


UR 


BE 


GI 




NT 












28. 


FS 


WV 


UZ 


OV 


FD 


OL 


XO 


SB 


IP 


PH. 






MO 


VE 


ME 


NT 


OF 


Elf 


EH 


Y 








29. 


UP 


NT 


BI 


FY 


FG 


RO 


HZ 


QT 


PI 


OP. 




IN 


PO 


RM 


AT 


10 


N 












30. 


HZ 


SF 


WD 


NQ 


DP 


NQ 


ZO 


LF 


IR 


XR. 




31. 


HU 


HX 


XY 


BU 


LO 


WZ 


PD 


CR 


RL 


ZB. 




32. 


HK 


PG 


UZ 


OV 


UB 


ZQ 


FH 


LP 


ET 


EA. 




BE 


GI 


ME 


NT 


AL 














33. 


NT 


zu 


BH 


NC 


UC 


ZU 


CS 


KU 


EO 


TC. 








EM 


YA 


RT 


IL 


"TS" 


RY 










34. 


AH 


IG 


IT 


BV 


EA 


VF 


PT 


AK 


NZ 


ZU. 




BA 


DI 


0 


















35. 


NM 


WV 


OV 


SP 


OX 


B6 


OZ 


YK 


SC 


RC. 




SE 


VE 


N 


















36 . 


HR 


IB 


HE 


AM 


BU 


DA 


OX 


YD 


IM 


OV. 




37. 


HK 


TG 


NC 


VS 


QE 


XB 


GB 


XO 


OZ 


PN. 




BE 


PO 


RT 


EN 


EH 


Y 












38. 


GL 


WV 


YG 


DC 


EO 


CD 


RL 


ZD 


ZO 


FL. 






FI 


VE 


RE 


GI 


ME 


NT 


S 










39. 


GL 


AQ 


SN 


FY 


HI 


CU 


NZ 


LC 


KP 


PK. 




FI 


BS 


TB 


AT 


“t3T 


LI 


ON 










4o. 


LQ 


KZ 


UO 


BO 


BI 


CT 


NZ 


KB 


HW 


OX. 





UI ON 
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d. with so many plain-cipher equivalencies per column, reconstruction 
of the squares will be a very easy matter. The squares as recovered for 
the first three columns are the foUotfing: 



F G K M E 
0 F Q S N 
V W T 
f D R A H 
LI U 



Square No. 1 



Z E V W X 
A K F D R 
B Y H I C 
M U 0 G K 
S L T P Q 

Square No. 2 



D K A N F 
R F B Y N 
1 M U 0 
C S L T 
X Z E V 



Square No. 3 



Square Ho. 1 is recognized as containing a keyword-mixed sequence, so this 
square is rewritten in Its original form, with the missing letters filled 
In. It Is noticed that three of the columns of square Ho. 1 are cannon to 
square No. 2, and that three of the colxunns of this latter square are com- 
mon to square Ho. 3; these three squares eu:e therefore rewritten as follows: 



0 R A H F 

1 C B Y N 
G K M U 0 
P Q S L T 
W X Z E V 

Square No. 1 Square No. 2 Square No. 3 

A few moments' inspection will now reveal the relationships among the three 
squares; each succeeding square is derived trosa. Its predecessor by permuting 
two columns at a time, as demonstrated In subpar. 91e« Since we now know 
the method of square generation, we may read any message in its entirety 
without further ado after ve have generated the pertinent band of Playfair 
squares. 

e. The foregoing system was fairly easy to solve because of Its pro- 

gressive 1, 2, 3*«* selection of the Playfair squares from the band. If 
the order of square selection had been different, say In a scrambled order 
of 23 squares as treated in subpar. it would probably have been neces- 

sary to make entries In quite a few columns in order to reconstruct eno'i^ 
partial squares before we would have been able to see any relationships 
among the squares. 

f. Once the Playfhlr band has been recovered, a message starting at 
any a^ltrary point in the band may of course be read, since one of the 23 
possible trials will yield plain text. If the sane band continues to be 
used, but there Is employed an unknown mixed sequence to govern the pro- 
gression of enciphering squares, then a modification of the generatrix 
method is here applicable. For example, let us consider the following cryp- 
togram, known to have been enciphered with the Playfair band Just recovered, 
but with an unknown 23 -element progression: 



RQ 


CP 


Cl 


IT 


TP 


CL 


ZL 


GP 


TD 


GH 


SC 


xw 


RQ 


XV 


El 


EW 


ZC 


RW 


ZN 


HS 


PI 


BT 


WI4 


KY 


QD 


IF 


HI 


UX 


XY 


FG 


DI 


PV 


MT 


VG 


VY 
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H 


Y 


D 


R 


A 


U 


L 


I 


C 


B 


E 


F 


G 


K 


M 


N 


0 


P 


Q 


S 


T 


V 


W 


X 


z 



A H F D K 


B Y H R 


P 


H U 0 I 




S L T C 




Z E V 


X 
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The procedure here is to eonplete the "plAin eoepoiient (digraphle) sequence" 
from the cl^dier digraphs by deeliAterlng each digraph successively through 
all 23 squares. For example, the first digrai^ RQe represents XKp in 
squares No. 1 and 2, Pip in squares No. 3 ud WNp in square No. 3t 
The complete generatrix diagram for the first ten dlgrai^s is the foilowlng: 



RQ CP Cl 



IQ U 
XK IQ IN 
PI HR IR 
PI HR IR 
HN QT TO 
m NC TO 
FO RC TO 
^ QI AC 
HD QI AC 
LC QT RE 
IX HT RE 
YL HT DO 
YL BO BQ 
DM BO YU 
YL RY YU 
YL TH ON 
TB YN ZF 
ZS YH ZF 
jTO ST TN 
|0 YN TN 
TO MN ON 
m YN YU 
LC YN YU 
CK YZ YM 
CK DM DQ 



IT TP 



UH HN 
NP LT 
OC HN 
OC HN 
01 DT 
61 AC 
GI AC 
CK HI 
CK HI 
EN NT 
EN NT 
06 ZT 
BS ^ 
EX ^ 
MQ ZH 
MQ ZM 
TQ DQ 
TQ DQ 
FH CT 
FH YI 
FH YI 
^ NT 
^ NT 
NP ZT 
UH HN 



CL ZL 



lU VB 
YQ E8 
T3 ES 
ZI 
NB 

NY IB 
SO FO 
OH FO 
OY XO 
RY DR 
RY DR 
m RK 
BI RK 
BY RK 
^ ET 
HT ET 
HY CY 
VN VQ 
SP UC 
HO KO 
OH HC 
OY HC 
RY DC 
RY HC 
YQ VQ 



GP TO OH 



16 HH ED 
16 PF 05 
XR CF ED 
XR CF MR 
XT DS MT 
QC DS QF 
QC FV QF 
HQ 8A BF 
HQ nr BF 
HQ 8A HV 
BH SA BY 
BH SC BY 
OH SA OY 
ES XA UF 
HN OK UF 
ZH OK IN 
MN jTO FN 
HN ra FN 
MC PF QX 
MN HH OX 
ES HH DA 
FS BM MR 
IH HH TO 
IH HE NL 
16 HH ED 



By reading various levels of the generatrix diagram, it may be seen that 
the message begins "HOSTILE PATOOL SIGEQSD. . . " 

It vlU be noted that the equivalency CPc ■ s!^ is unique to 
square No. 19, and that CIc * ILp is unique to square No. 1; therefore 
these squares nay be ruled out as key squares for any other positions 
along the cycle of 23, The multiple keys for the first 10 digraphs are 
as follows: 



C: RQ CP Cl IT TP CL ZL 6P TO 6H... 

P: BO ST IL EP AT RO US 16 HT ED 



19 1 22 13 12 



2 17 



23 14 15 5 25 18 23 
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The first 10 keys mle^t be made unique by considering the declphennents 
of the cli^r dlgra^Ais In the next cycle. Since ve have limited the possi- 
ble keys In the foregoing diagram, only those keys come Into question In 
the corresponding positions of the next cycle. The decipherments, there- 
fore, of the dlgra^du In the next cycle are as foUows: 

TFMIUXagPSDIfVMrVGVY 
1. CT 



2 OB 

3 EN 



il'. .. 

5. .. 

6. U 

7. 

8 . SK 

9. WA 
10 . 

11 . 

12 . • • 
13. .. 
Ik. .. 
1?. .. 

16. 

17 . . . 



18 EC 

19. • • . .UN 

20. FI 

21 . 

22. IN 10 

23 VR FP 

2k, 

25 NZ 09 



The plain text revealed, ”..,03 UN CT 10 NS IX Ttf 08 EF Bf", Is In this 
ease found In unique squares, so the unambiguous key for the first 10 posi- 
tions Is found to be 6 19 1 ^ 1^ 12 5 2 17 3. When the rest of the plain 
text Is solved, It vlU be found that of the remaining 19 columns, all but 
4- vlU yield, \inlque keys; If ve had available another message or tvo, the 
ambiguity could probably be removed from the 4 ambiguous columns. 

94. Analysis of other types of periodic dlgranhlc systems.- - a. Since 
there Is a plethora of possible basic dlgrai^hlc systems vhlch may be used 
In conjunction vlth a polyalphabetlc scheme, each case will present differ- 
ent aspects In Its scdutlon, depending on idiat may be knovn Initially about 
the system, and what phenomena are uncovered and recognised during the pro- 
cess of solution. A s\ifflcient volume of traffic, plus the Inevitable 
cryptanalytlc breaks which may be expected to occur In the course of the 
use and misuse of the system, are the deciding factors for successful solu- 
tion. 



NX 

W 

CE 



....a 

GH 

NS 

....YQ 

EV 
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b. In a B^tam Bueh as tbat illustrated in Fig. 128, once the period 
has been detemined by ftetoring (with perhaps the dlgrapUe f test being 
used to prove the period), plaintext assunptiona in the messages would be 
recorded initially in several skeleton 26:^ matrices, one for each column 
of the period, until enouc^ data have accumulated to permit the revelation 
of the relationships latent the matrices a.Tnnng t*»«i gets of co- 

ordinates. If the composition of the interior of the matrix were known, 
even a single crib of moderate length mL^t suffice to establish enough 
values in the sliding coordinates lAleh would result in further autonmtic 
decryptions and rapid carnation of the solution. 

e. In those digraphic systems whicdi yield trlnomss for the cipher- 
text equivalents for plaintext digram, the primary cipher text mle^t be 
subjected to encipherment by a cyclic additive as a means of increasing the 
secixrlty of the system. For example, the basic system might incorpo r ate a 
idatrlx such as that illustrated in Fig. 132, below:^ 



j u P 



TERABCDFGHKLMNO 







Figure 132. 



For another type of tnnome-dlgraphic system, see subpat. 6W, in Military Cryptanalyucs, Part I. 
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Such an addltlva-eneiphered digrai^e ayaten could poae eonaiderable ob- 
ataclea in the vay of eryptanalyala; nevertheleaa, given enough traffic, 
and given enough apecial circumatancea which, aa the atudent haa cone to 
appgreciate, are inevitable when any ayaten ia uaed among a group of corre- 
apondenta over a period of tine, aolution of auch a ayaten by a ataff of 
expert and trained cryptanalyata ia only a natter of tine and labor. If 
the matrix and ita coordinatea become knovn, either throu^ conpromiae or 
by analytical reconatruction, then a crib attack ia an eaay entry into 
vhat would otherwiae be a very difficult ayaten. 

95. Additional renarka. -- a. The gueation of diagnoaia and recogni- 
tion of periodic digraxdiic ayatana haa been touched on rather lightly in 
our diacuaaion thua far. it will be helpful to iUuatrate aone general 
eoncepta which nie^t facilitate the identification of thia family of aya- 
tema. 



(1) Let ua auppoae a hypothetical ayaten, in which four 4-aq]aare 
natricee axe uaed in aucceaaion in a neaaage. That ia, the lat, 5th, 9th... 
digraj^ are enciphered with Matrix Ho. 1; the 2d, 6th, 10th... digraidia 
are enciidiered with Matrix Ho. 2; etc. TUa nay be dlagramaed aa foUowa, 
where the ligaturea dealgnate the lettera enciphered digraphlcally: 

ee M ee 

The characteriatica of auch a ayaten would be: (a) the abaenee of one 

letter, uaually J, in the traffic; (b) the preaenee of cyclical phenomena 
in the polygraihle repetltiona preaent that would indicate a period of 8; 

(c) the general inadequacy of the monograj^c ^ teata for the 8 dlatribu- 
tiona , inelijding an inaufflclency for the moat part in the expected number 
of blanka; (d) the prevalence of repetltiona of an even mmdber of lettera, 
which repetltiona would begin for the moat part in alphabeta 1, 3, 3, and 
7, and would have the tendexusy to end in alphabeta 2, 4-, 6, and 8; (e) good 
reaulta in dlgrafAile dlatrlbutiona, when the dlgraphlc ^ teat la api^ied to 
the ped.ra 1-2, 3-4, 5-6, and 7-8, and poor reaulta when the teat la applied 
to the palra 2-3, 4-5, 6-7, and 8-1; and (f) negative reaulta when the di- 
graphic ji teat la applied, ahoving that the four dlgraphlc enclphementa 
are cryptographically noxdionogeneouB. 

(2) How let ua conalder what would happen if, inatecMl of the dlgraphlc 
enclptement of aucceaalve paira of lettera, aone other type of pairing ia 
uaed, auch aa one of the following examplea: 

Caae a: P 9 9 9 9 9 9 9 
Caae b; 9 9^ 9"9^9*9 ^ 9 
Caae c: y 9 9^^9^ > 9 ^ 
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When counts are made on the digraEdis composed of enciphered adjacent letters 
of plain text, as In the example in the preceding subparagraph, the dlgraphlc 
K p Is .0069; it is this constant which will be used in the ai e r«phl c ^ and y 
tests as a measure of the relative "dlgraphieity” of the ciiher text.^^ If, 
however, the plaintext elements which are dlgraphlcally eneixfliered are n^t 
adjacent letters In naming plain text hut are widely separated, then tST" 
digraphs thus formed do not foUow the Araquency of English plaintext dl* 
graphs, hut Instead depend upon the product of the indivi«iM*>'l prohahilltles 
of English plaintext letters, so that am- itp in -hM^ Ytft 

square of the monographic Kp^ (.0667)2 - .0041^. This same constant, .0044, 
would he true in any dlgraphlc encl|dtoment of a more or less rszidam assort- 
ment of letters taken ft-om a population having the prohahUities of English 
plaintext letters; thus It applies to a digraxhle eneii^ment of a trans- 
position cipher, or the encipherment of the vertical pairs in a periodic 
"serlatlon" such as in the fdUowlng example:^^ 



R(BrBR 
B H C E Y 



^O^U^R^M^B U H B E 
8 S A G B R... 



Ihe highest frequency digraph of the units thus formed would he Sp; next 
would he the digraphs and TSp; and so on. In descending order of the 
products of the prohahUities of the Indlwldual letters composing the dl- 
grai^.^^ 

(3) In ease a^ above, the digra^e iCp would he less than .0069> hut 

higher than .0044, since the fireqioeneles of repeated trigraphs in English 
plain text govern an afflnlty^tf c ombin a tion fo r ce rtain letters with others; 
e.g., the frequent trlgraphs lOBp, iMGp,... will influence the 

blghw probability of the separated digraphs iSp, JSp, IGp, etc. In 
ease ^ however, the digraphic Kp would he .00^; and in ease e^ whereas 
the Kp of the digraphs 1-6 and 2-7 would he .0044, the Kp of the dlgrai^ 
3-6 would theoretically he a shade above .0044 (a refinement indlstlnguish- 
shle in actual practice), while the dlgrapdi 4-5 would of course have a Kp 
of .0069. 

(4) It follows, then, that given exmugh material, the digraphie ^ 
test vBy he used to diagnose a periodic dlgraj^c cipher, to include the 
manner of pairing the plaintext letters to produce the cipher digraphs. 
Furthermore, the dlgraphlc % ^Bt may he employed to discover whether all 
the dlgraphlc eneli^rments are cryptographically unique, or whether the 
same digraphie treatment has been applied to more than one pairing in the 

The R|, constant is the reciprocal of the number of elements possible In the distribution, thus the usual 
value for the dlgraphlc k. is = .00148. In the case of systems employing 4-square or 2*square matrices, 

1 1 
die Kj is = .00160; if the system employed Playfair squares, the digraphie Is = .00167, since 

doubled letters are usually excluded m this ciphetl 
13 

In this example, having a senation interval of 5, if the last block of 10 letters were incomplete, it would 
be padded by enoqgh nulls to permit the encijdierment of the ftve vertical (4giaphs. 

The solution of ^tems such as the one just desciibed will be taken iq> in MUitary Cryptanalytics, fart IV. 
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periodic dlgrai^le eystem. A resune of tbe fomilas need In dlgrai^e 
analysis Is given belov. When the dlgra^ are composed of enciphered 
adjacent letters , 

2^p - .0069N(H-1) 2 '^m ■ .0069Hi% 

at, - .0015»(M-1) ■ .OOI 5 H 1 H 2 

For digraphs composed of enciphered separated letters, 

2tp 3: .004iUl(l(.l) 3: .004i|]lxl]2 

ati ■ .0015N(M-1) ■ .OOlSHiIfe 

(^) A rather Important consideration that may he overlooked or for- 
gotten by the student of cryptaxudytlcs. Is that the t tests on the Initial 
and final letters of a dlgraphlc substitution employing 4-square, 2-squsre, 
or Playfair matrices are far from being random distributions. Since these 
matrices produce only a partially dlgraphlc exiclpherment,^^ then the encipher- 
ments of EHp, ERp, SSp, ElFp... may result In a series of cipher digraphs In 
which the Bp has been enciphered more or less monoalphabetlcally. However, 
the use of a well-constructed 26x26 table will yield a dlgraphlc encipher- 
ment wherein the unlllteral frequency dlstrlbutloxis of the Initial letters 
and final letters have random characteristics. 

(6) Some pertinent observations may be made here regarding repetitive 
phenomena In cases such as a^ ^ and c of subpar. (2), above. In ease ^ 
repetitions will begin predominantly Tn alphabets 1 and and end In alpha- 
bets 4 and 8; In ease ^ repetitions will usually begin In alphabet 1 and 
end likewise In alphabet 8; and In ease e, the delineations of the repeti- 
tions will either be flrom alphabet 1 to alphabet 8, or alphabet 2 to alpha- 
bet 7 , or alphabet 3 to alphabet 6. Ihus, causal tetragraphlc repetitions 
are possible in ease a in the first four or last four letters, and tetra- 
graiAilc repetitions are also possible in case e In the middle fCur letters; 
but In ease ^ causal tetragiraphlc repetltlons~have been effectively sup- 
pressed. 

b. It might be of Interest to point out that periodic cryptosystems 
have been constructed which contain IntermixtureB of monographic and dl- 
graphle treatment, usually for the purpose of achieving a "com p l ex ity" In 
the cryptographic system and thereby defeating eneny cryptanalysis. Such 
poor subterfu^s are— as we have Just said— poor; nevertheless, s imil a r Ideas 
are sometimes encountered In examples of poor cryptography. The monographic 
encipherments In these systems ml^t be unlllteral In form, or blllteral; 
and in the latter case, the two cipher elements concerned might be adjacent 
elements In the cipher text, or separated In the cycle of a period-length— 
as another cxyptographlc trick to deter cryptanalysis. 



Cf. subpar. 68b, Military Cryptanalyucs, Part I . 
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c. Ihe Buperlmposltlon of snssa^s eselphered In periodic digraplilc 
systens Is accomplished generally In the same manner as Is the ease vlth 
monographic ciphers, l.e., aligning the messages by means of known indica- 
tors, or Ju3Ctaposing messages so that long polygraphic repetitions present 
are exactly super loqposed. In addition, long messages might be correctly 
superimposed by means of a modification of the kappa test; this test vlU 
be treated in the next chapter. 
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96. Mleeellaneoua periodic polyalphabetic systems »— -a. In all the 
systeaM treated thus Ihr In this t«t, each alphabet was used suceeBBlTely 
to Oneipher BueceBBlve Blngle plaintext elenenta, monographic or dlgraphie. 
There la no reaaon, however, vby each alphabet night not be need to encipher 
2, 3, or more aucceBBlve lettera at a tlan; thia haa the apparent effect of 
doubling, tripling, or n«tupling the length of the fundamental period, but 
at the expenae of a correapondlng reduction in the cryptographic aecurity 
of the ayatem. 

b. Aa an example of auch a ayatem, we may cite that uaed by the 
Ruaalana during World War 1 and known In cryptologic literature aa the 
■^prungchlffTe"; thla la lUuatrated In Fig. 133, belcw:^ 



3 

1 

5 

6 
7 
6 
2 



AEBrnEX 3 HKJIMKOnPCTy«XU'ini]n«DAb'blltiI 

31 61 81 79 57 35 12 56 46 7 t 37 * 0 . 89 43 45 l »7 97 65 32 59 24 39 38 86 13 81 » 23 85 62 17 54 58 14 
31 21 81 79 4 h 56 72 26 83 27 37 61 89 43 28 23 97 13 29 59 36 32 38 73 63 24 64 85 4 l 17 25 51 46 
15 37 21 64 31 17 67 25 49 69 18 23 35 93 59 86 52 13 46 89 74 98 28 47 72 42 45 24 48 67 34 65 39 
86 92 52 23 18 97 36 13 46 67 54 71 19 14 65 27 93 85 16 79 12 58 76 48 83 34 26 74 62 38 37 29 81 
25 31 17 42 38 13 4 l 61 23 45 89 15 84 75 48 54 34 73 14 53 37 24 64 18 28 12 95 57 93 78 82 76 27 
41 64 84 43 92 53 85 34 67 71 27 26 46 49 24 58 31 75 18 23 98 29 62 39 42 51 95 65 17 96 13 91 94 
12 56 82 74 13 38 96 54 61 37 83 26 49 68 39 65 57 16 23 95 48 31 78 17 59 73 14 72 98 52 4 l 53 69 
73 86 31 93 42 56 21 62 19 47 75 61 32 59 28 84 14 71 35 91 87 69 16 13 25 76 89 38 64 94 95 83 29 



Figure 133. 

( 1 ) Thla baalcally la a dinome -for -letter aubatltutlon with 8 random, 
unrelated alphabeta,^ uaed In conjunction with a apeclal indicator procedure. 
The enciphering clerk begina hia meBaage with a 5-diglt "atutter" group 
choaen at random, auch aa 444M, which Indlcatea how many conaecutlve plain- 
text lettera are to be enciphered by each alphabet. He then eneiphera the 
flrat four lettera (If la the Indicator) with the alphabet labeled 

"1", after which he eneiphera the next four lettera with alphabet "2", and 
BO on, repeating the cycle after al^iabet ”8" la uaed. At any point during 
the encipherment after a block of lettera (in thla caae, 4) haa been en- 
crypted, the clerk might Introduce a new atutter group, auch aa 66666, which 
would indicate that each alphabet firom now on (without dlaturblng the ae- 
quence of alphabeta) will be uaed to enei]^r alx conaecutlve plaintext 

1 The matnx illustrated and a description of the cryptography of the system were taken from Andreas Figl, 
Systeme des Chiffrierens, Graz, 1926, pp. 84-85 and Appendix 19. 

^ The dinomes in the cipher components did not include the digit 0, nor were there any doublets such as 
11, 22, etc. 
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letters. Tbe final cipher text vaa tranaaltted In 5-dlglt groups. For 
declphement, a separate deciphering table vas necessary. 

(2) Changes of keys In this system were effected merely by changing 
the designations of the 8 al^iabeta, the basic matrix remaining fixed for 
a considerable period; in fSct^ according to official German historical 
records, the random cl]^ier components of the matrix seem to have been 
changed only tvlce during the life of this cryptosystem.^ 

(3) The cryptanalysis of this system Is obvious. If the matrix and 

details of the system were uhknovn, the study of even a small amount of 
traffic In the same key would establish the meaning of the stutter Indica- 
tor group, disclosing the basic periodic!^ as 8 alphabets, nie general 
method of attack Is then along the lines Indicated In subpar. In this 

latter connection, we would be aided by the idlomorphlsms which will mani- 
fest thsamelves idien a single alphabet Is used to encipher several consecu- 
tive plaintext letters; the word KOMUCCMH, for Instance, will quite likely 
yield an ABBA pattern In the cipher If the Indicator Is 44444 or hl^er. 

Once the matrix becomes knoira, new alphabet keys may be recovered by a modi- 
fication of the usual generatrix msth^.^ 

e. The 4-level dlnome variant system Illustrated In subpar. of 
MllltMTr Cryptanalytles , Part I. lends Itself to pdlyalpbabetlc treabnent. 
Ihe basic system, as the student will recall. Involves a matrix with a 25 - 
letter (laj) plain component, and four cipher sequences consisting of 25 
dlnomes each Un noxmal numerical order, Ql^S, ^-$0, <uod 76-00). 

These sequences, aligned according to a specific key, constitute a matrix 
providing four cl0ier equivalents for each plaintext letter. 

(l) In Fig. 134, below, there Is Illustrated a polyalphabetlc modi- 
fication of this system: 




ABC DBF 0 H LT KLKR0PQR8TUVW XTtZ 



01 02 03 (Aj ) 25 01 02 03 OA 05 06 07 oa 091011 1213lAl5l6l7lBl9 20 21 22 23 2l» 



IMJ' 



3 5* 55 



98 99 0O 76 77 76 79 S08ia2 83 8A 85 66 87 88 89 9O919e 93 9l»95 969T 



















Figure 134. 



^ Thu system, introduced toward the end of 1914, was so cdumsy to use and caused so many requests 
for retransmissions- 'because the Russians were often unable te read theu own traffic- -that it was wididrawn 
even before the year was up. The Russians, unaccustomed ro such complications, reverted to the simple 
substitution ciphen ( ' ) they had previously been usmg. 

^ We could even Identify a particular alphabet from occurrences of certain dinomes which are unique 
in the matrix (such as, in Fig. 133, the dlnome 63 in alphabet "2" and 68 in alphabet "7”), or from the 
ten different dinomes which occur In only two of the alphabets (such as 15, occurlng in alphabets ”3" and 
"5”). 
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Tbe four sequences an printed on sliding strips which are fkwe to slide 
Individually In a fnae against a noml plain eonponent. The Initial 
dlnones (Olj 26, 76) of the strips are here shown aligned to the 

letters B, B, A, D, respectively, constituting tbe first specific key. 

These strips are now locked into place with respect to each other, and 
the entire conpound strip is moved to provide a feature of polyalpba- 
hetielty, controlled by a second specific key. For instance, if the dl- 
none 01 in the now-fixed compound atrip were set successively against the 
letters B, A, 8, K, B, T during the enci^iexiiient of successive plaintext 
letters, we will have a periodic polyalphabetic substitution system with 
variants . 

(2) Tbe cryptanalysis of this system, too, is quite apparent. Vhat 
we have Aindamentally is a repeatlng-key system with standard alphabets . 

This gives us at once the obvious cue: factor tbe message, convert the 

cipher letters of each alphabet into their plain-component equivalents, 
and eomi^te the plain -component sequence. The particular steps for such 
a system have been treated in subpars. 60n-£ of Military Cryptanalyties . 
Part I. ”” 

(3) the alphabets had not been standard alphabets, the story 
would be quite different. Fortunately, in such a ease the system would 
become cryptographically preposterous, with tbe probable result that tbe 
eneny's cryptocommunications would break down if such a system were in- 
troduced. But even if such a system with mixed ali^bets were used, the 
application of the principles expounded in this text, and the availability 
of a reasonable amount of traffic, ^rould lead to solution, albeit laborious. 

d. Polyalphabetic systems have been encountered in which vowels have 
been enciphered by vowels, and consonants by consonants.^ This featinre 
usually has been prompted for reasons of eeonony existing in once pre- 
vailing telegraph company rates. The following sectional matrix ^ la an 
example of a system possessing the vowel-to-vcwel feature: 
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Figure 13?. 

Other sectional matrices might be crastrueted in which the cipher equiva- 
lents for plaintext vowels are chosen from a group of six cipher letters. 

^ We have already seen an example of this In the system described in par. 76. 

6 A sectional matrix is, as the term impltes, a polyalphabetic substitution matrix with two or more 
distinct sections. The Porta table is an example of a sectional matrix, as Is demonstrated by the equiva- 
lent matrix illustrated in subpai. 23a_, on p. 59 . 
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In such a system, the plaintext letters AEIGUY, comprising of the text, 
vlU be replaced by the six new vowel -equlralents In question. The vovel- 
equlvalents can be picked out of the unlUteral distributions on the basis 
of their outstanding frequencies; and supporting evidence nay be found In 
the "vowel -like" positional spacing of these letters In the cipher text of 
a cryptogram. While we're on the subject of sectional matrices. It ndfi^t 
be mentioned that matrices with multiple sections are also possible, as 
exemplified In Fi^ 136, below: 
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Figure 136 . 

e. Periodic cryptosystems have been encountered In which the alpha- 
bets used consisted of both direct standard and reversed standard alphabets. 
The rule governing the choice of one type or the other, might be based (l) 

on the position of the key letter In the repeating key (e.g., the odd letters 
of the key to be enciphered with direct standard alphabets, the even letters 
with reversed standard) , or (2) on the parity of the key letter In the nor- 
mal alphabetical sequence (e.g., key letters In the ACEGI... family to be 
enciphered with direct standard, and key letters In the BDFBJ... family to 
be enciphered with reversed standard alphabets) . Examples such as these 
should pose no difficulties; the principles of their cryptanalysis have 
been covered In Chapter IV. 

f. The student has seen that, idien the cipher component in a periodic 
cipher Is the normal sequence (or any other known sequence) , matching of 
the Individual unlllteral Arequency distributions for each ^phabet Is 
possible, reducing the polyalphabetlc cryptogram to a monoalpha b etlc cipher 
Ebw let us assume we have at hand a particular periodic polyalphabetlc 
cipher of several hundred letters, factcnring to six alphabets. We observe 
that we are able to slide the unlllteral distributions tcx alphabets 1 and 
2 to an excellent match, confirmed by the % test; alphabets 3 end k are 
also slid to an excellent fit with respect to each other; and likewise alpha- 
bets 3 and 6 axe also slid to a correct natch. Yet It is Impossible to find 
a good match for the three combined distributions. In spite of the paradoxi- 
cal fact that the cipher component must have been the normal sequence to 
enable us to match any distributions at all! The obvious explanation (which 
Incidentally was far Aram obvious when this situation was first encountered) 
Is that the cipher components for the first two alphabets consisted of the 
normal sequence; the cipher components for alj^bets 3 and 4 consisted of 

a decimation of the normal sequence; and the cipher components for alphabets 
5 and 6 consisted of a different decimation of the normal sequence. (The 
plain component was a mixed sequence.) This demonstrates to the student 
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once ageln that he must alvaya keep an open mind In explaining xAienomena, 
however "Incongruous" or "inexplicable" they may he. It is the "Improba- 
ble" system which may resist the efforts of the cryptanalyst, until he 
easts aside preconceived ld$es fixes and rationalizes the causes of the 
manifestations present to reach an ultimate solution.^ 

97. Periodic Baudot systems.- - a. In the previous text we became 
familiar with the International Baudot code used in teleprinter communi- 
cation.^ !Ihls code is reproduced for convenience in Fig. 137i below: 



jppgp |VIEA1>CR SYMBOLS 
CASE I COMMUNICATIONS 





II II — ■■■ ■■ ilBhll !■ ■■■■ II ■■ ■! 11 1 ■ 

aaBBBBaflMaaBBBBBBBBBBflHBBHBB 




Figure 137 . 

There are many methods for accomplishing the encryption of teleprinter 
signals, ranging from primitive svltehlng devices yielding nothing more 
than a simple substitution, to systems Involving complicated apparatus 
producing encrypted signals of great security. 

b. The first encrypted teleprinter system was Invented during World 
War I*~by an American engineer, Gilbert S. Vemam, who called It the "Cipher 
Printing Iblegraph System." Basically, the Vernam system Incorporated a 
specially prepar^ tape of random teleprinter characters used to key another 
tape containing the plain text to be encrypted. The two tapes were fed Into 
a "tape reader", and the Impulses from these two tapes were cond>lned by what 
Is known as "encipherment according to the Vemam rviLe", or, more simply, 
"Baudot addition." That is, liliw Impulses or bauds combine to form a "mark" 
(symbolized by •»], whereas unlike impulses result In a "space" (symbolized 
by -). For exaoqde. If the character on the keying tape Is -***- (b C) and 
the character on the plaintext message tape Is ** — (■ A), then the result 
by Baudot addition is -♦—■ » (« L). Of course, by a simple modification of 
the electrical circuit, the rule of addition could be changed to one where 
like bauds produce a space and unlike bauds a mark; but the general nature 
of Baudot addition remains the sams. 

c. ihe Vemam system was designed originally to use a long keying tape 
of ai^oxlmately 100,000 characters. If the tape were actually random and 
if It were used only once (i.e.. If no portion of the tape were ever used 
for more than one message) , then the system would Impart absolute security 
to the traffic. However, the practicability of production and distribution 

B In this connecQon, the student would do well to q>end 60 seconds In meditation on the quotation from 
Aristotle on the back of the utle page of this text (from die Politics , i. 2. 9, 1253 ^ 

^ At this point it is lecommended that the student review the material covered in par. 56 of Military 
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of these tapes becomes quite a problem, especially if the traffic trans- 
mitted is large in volume, and if tbere are a large nunber of coxrespond- 
ents vho must Intereasominleate in the system. !I%erefore Vemam proposed 
that two key tapes in the form of continuous loops be used together, the 
lengths of which should be prime to each other; the interaction of these 
tapes would generate a very long keying sequence. For instance, if the 
two key loops consisted of 1,CX)0 and 999 characters, respectively, then 
the resultant key would be the product of the lengths of the tapes, or 
999, OdO characters. This key would not be, strictly speaking, a purely 
random key, since it is derived from the interaction of two primary com- 
ponents; nor would the security offered, under actual operating conditions, 
be as great as ml£^t be imagined. For certain types of traffic, Vemam 
even proposed as a convenience the use of a single tape loop constituting 
a short repeating key; the security of this scheme is either negligible, 
or only two or three times that amount. 

d. Let us now consider the mechanics of Baudot eiwipherment. Since 
the international Baudot code is a known alphabet, it foUovs that we 
should be able to read two or more meaaages enclptered with identical 
keys. Suppose we have the following begixmlngs of two messages which 
possessed identical Indicators, and are therefore assumed to be in flush 
depth: 

Msg "A": -+— ♦ +++<■+ +4'-++ — +- ♦ — +- — ... 

Msg ?B": +— 4+ 4-4-4 4-4- -4— 4--4- ... 

Zf we assume that the first message begins with RBp (■ -4-4- 4——), we 
will derive as key^° the fragment 444 — 4- — (■ 1%). This key, when 

applied to the begixming of Message *%”, yields 4— 44- (■ Sl^). 

This certainly looks promising, and if we extend the RBp into RBQlUffiT, 
we will get BiEMZ PA... in Message And so on. 

e. In practice, teleprinter signals are not analyzed baud by ba\id 
as In^tbe foregoing exeuiqple; Instead, each group of five bauds is tran- 
scribed as a single Baudot character, and treatment is applied to the 32 
Baudot characters resulting from this transcrlption.il In cryptanalysis, 
we make use of Baudot combination tables which contain all possible eom- 
binatlotis of the 32 characters and their Baudot sum. Such a table is 



10 We aie assuming here the keying convention that like unpulscs produce a ”4”, unlike a This 
asiumpuon, however, is (except in certain rate cases) immatenal, ^ opposite rule might actually have 
been employed In the encryption, without our eldier knowing it or being able to prove it . 

11 As mentioned in the previous text, it is customary in cryptanalytic work to symbolize the character 
representing the carriage return by the digit "3", die line feed by "4", the figure dilft by ”5”, the blank 
by "7”, the letter shift by "8”, and the space by "9". The beginner should be careful not to confuse these 
symbols with plaintext digits. 
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Figure 133a* 

illustrated in Fig. 138a, containing Baudot sums eonblned according to tbe 
rule that like bauds produce a ”<«■", unlike a In Fig. 138b we have 

the compleBientary table of Baudot Bums coinblned according to the~rule that 
unlike bauds produce a "•i'", like bauds a As has already been men- 

tioned, it is Irntnaterlca which rule of addition is assumed; but once a con- 
vention is established, it must be continued in the particular problem 
under study. For tbe sake of uniformity, in this and the following texts 

The student will note that in Baudot addition, because of the binaiy basis of the arithmetic, P + K = C, 
P + C = K, and C -f K - P, Thus, in Fig. 138^, it will be seen that any combination of two of the diatactets 
A, B, and S will yield the third character given. 
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ABCDEFGHIJKLMMOPQRSTUVWXYZ3U5789 
7 6 F R 4IC B Q S 3|N Z 8 K 5|y H D 1 W|9 X T V P lIj E 0 A M U 
G7QT0HAF8LPJSYEKCWMDVUB9U3Z^4BIX 
FQ7UKAHG3SEML4POB9JVDTXW581NYCZR 
RTU739WXK412YSZ8VANBCQGHMOEJLDPF 
40K37M5YURCWXFBQPJ9ZI8LMHTDAGEVS 
CHA 9 N 7 QBJI 4 & Z E Y 5 GU 3 XRWVTOMSKPFLD 
BAHW^Q7CMZY3IP4NFT8RX9DUKJL0£GSV 
QFGXYBC7L85I30N4AVZ9WRUDESMPKEJT 
S83KUJHL7FDHGRVTZliAPEOY5VQC9XlB4 
3LS4RIZ8F79BQUWXMEC5HYOPVGADTJHK 
N P E I C TTTyD 9 7 X W A Q B 0 S R 3 3 ZMLGVUFHKTJ 
ZJM^W831HBX7CVR9S0Q4YNEKUAGT1>LFF 
8SLYXZI3GQWC7T9RJPBN54KEDFHVUMAO 
KY4SFEFORUAVT7HG9IDMJL8ZBX9CQNW3 



5EPZBY4MVWQR9H7lCKLX3l8lJSFD[TGA0UM| 

Y K 0 8 Q 5 R 4 T X B 9 RGC 7 EMWIZ 3 SJAUVHFPDL (9^+8^) 

HCBVPGFAZMOSJ5KE7XLUTD9R4I8YNQ3W 

DW 9 AJUTVHESOPILMX 7 KGFHBQ 8543 ZRYC 

IMJR938ZACRQBDXVLK7Y45POTHFUVSGE 

WDVBZXR9P584NM3IUGY7aCAFSE0LJTKH 

9 VDCIRXWEM 3Y5J82TF4Q 7 BHGLPKSMUOA 

XUTQ8W9ROYZK4LI3DH5CB7FAJKPMSVEG 

TRXGLVOUYOHEKdJS9BFAHF7Cl45Z3VNQ 

V9WHMTUD5PLKEZSJRQOFGAC73NY8IX4B 

PN5MHOKEWVGUDBFA48TSLJI379XQCYRZ 

L380TMJSQGVAFXDU15HEPK4N97BWRZCY 

JZIEDSLMCAUGH9T V 3 4 F 0 KP57XB7KW3QN 

E5NJAKOF9DFTVCGHY3ULSMZ8QWR7B4XI 

04YLGPEKXTHDUQAFNZVJMS3ICRMB7598 

ABCDEFGHIJKLMnOFQRSTUVWXYZ34?7d9 

MIZPYLSJBHTFAWUD3YGK0EN4RCQX5875 

UXRFSDVT4KJP03MLWCEHAGQBZY^I8 9 5 7 



8 I J S F D T G A 0 U M 



WDVBZXR9P584NM 

9VDCIRXWEM3Y5J 



7 aCAFSE0LJTKH 

Q7BHGLPKSMU0A 



Figure 13%. 

ve vlU always assume the eouTentlon that, unless othexvlse specified, 
hauds produce a tinnico a ”-".^3 



The reason for the inclusion here of the complementary Baudot table illustrated in Fig. 138b, is for 
puiposes of reference in ibllovang other tedinical treatments in which die mverse convenuon might be 
used. The table m Fig. 138^ can be derived from that in Fig. 138£ by adding ++-H-+ (= 8) to all the values 
in diat table. 
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f . Xhe complete texts of the two messages In flush depth given In 
subpar. ^ above, are as fblioin: 



Message "A" 



L 8 A 5 H 

HOIS? 


39CTB 

FFZVG 


KNMIH 

NA3CJR 


XEAFR 

NQOVH 


CGGPZ 


U3P8T 


EB5ZX 


JBD3K 


UWV 8 D 


9ZEFE 










Meaaage **B" 










BLY77 


DhDAfi 


V 0 D 9 J 


XSBCR 


80D77 


3 T.SSZ 


45XAU 


XGCE5 


FELG 8 


TPLHV 



dCntH 

Let us suppose that, in order to illustrate the method of sliding a proba- 
ble word, we had not already made an entry into the texts, and let us assume 
that the word ARTILI£SY is in one of the messages. The first thing we will 
do is to superimpose the two cipher texts and add these texts together, 
using the Baudot canblnatlon table for this purpose. Since the messages 
are in depth, this is equivalent to removing the effect of the key.^^ nw 
combined cli^r stream is shown below: 

L8A5H 39CTB KKMIH KEAER UGGFZ U3P8f SB^ZX JBD3K WVSD 9ZEFE 

BLgTT DtoAG VOPgJ KSHCR 80D77 3LSSZ 45YA0 KCCE5 FBLG8 TPLMV 

EU)^ VBGNM cjR^ uxNDC SmrT^s''"535w®5fro~3€®7 

noisy FFZV 6 NA3UB NQQVH 

gggiH 

X 3 BTJ 

Our next step is to use a diagram similar to that in Fig. 15 (in par. 22) 
to facilitate sliding the probable word. In the diagram below, the first 
row under the combined cipher stream represents the plaintext equivalents 
in one of the messages if the other contains the Ap of the probable word; 
the second row represents the equivalents on the trial that the message in 
question contains the Sp of the probable word; and so forth for all of the 
letters of the probable word being tried. If our assumption is correct, the 
word ARTUIEBI, when correctly placed, will yield plain text along a diago- 
nal, representing the plain text of the other message The beginning of 
this diagram is Illustrated in Fig. 139 , below: 

This may be demonstrated mathematically by the following: 

(1) Pi ♦ Cl « K ■ P|2 + C2 

( 2 ) Pi ♦ Cl ■ P 2 + C 2 

(3) ^ - P2 ■ C^ - C2 

( 4 ) P^ ♦ P2 ■ Cl ♦ C2 

(The founfa equation follows from the dilid because of the fact that In Baudot systems, addluon u Identical 
wlfli subtraction. ) The sum of the ciphers is proved to equal the sun of their plaintext equivalents; the 
effect of the key Is thereby eliminated. 'Hie use of the combined cipher soteam makes unnecessaiy the 
two-step process of Pi + Ci = K , followed by K + C2 = ?2 . 

IS At this stage we are not sure which message conulns die word ARTILLERY; this point wiU be resolved 
In die next subparagraph. 
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5 10 15 20 25 30 35 



A 

R 

T 

I 

L 

L 

E 

R 

Y 



HLD9JyB0HMCJRX7853M8UXHDCTSMS5MSZFS 

3CY0Q4S9T7LQPEMAUH7SA5STYLNBTBU7BFZB 

UMZVJKFBD9V83YRCXD^3BH33IBTCDT90T 

IJ9ZPQAWE9SLKTHUWT^AIE8RARHWRV1iR 

XLU7EYSQLW9BI4ZSIV^TQDMYM4SM3HM 

IWHYEZAIUTFLPSZLRTES9AX3B3PZ3M73 

WEYEZA1UTFLP8ZLRTE^X3B3P23N73 

UIL4TYHAVESP4EBALQ^3L3S43KW$ 

FBD5V83YRCXDRL3BM5^BTC0T90T 

lP9B7QBYZ4PYFQIA9aiCsIKZPK3UK 



Figure 139. 



Flrom the plaintext fragment ALUT9ACTI revealed along the diagonal^ starting 
at the 20th position. It Is clear that botii the presence and placement of 
the probable vord ARTH1EBY are confl:rmed. The two plain texts are now in- 
serted In the nssaages, arbitrarily assTnolng that ARTIUiEBY Is In Massage 
"A", and they are extended In both directions, yielding the following de- 
cryption^^ 



5 10 15 20 25 30 35 

Key: UEJARLJYMKBYW8WMXCPPLYA5MBXM9KB3LP3 
Ci:L8A5H39CTBKNMIHKEAFRUOGPZU3P8YEE3ZX 
Pi:R£QUEST9ADDITIOEAL9ARTILLERY9SUPPOR 

C2:BLY77B40AGV0D9JKSHCR80D773LSSZ43YAU 

F2:EREHY9FATROLS9UirUSUALLY9ACTlVE9HORT 

40 45 50 55 60 > 65 70 

Key: 94T5HPI7SG83R78 g40HKRA 

Ci: JBD3KWHV8D9ZkF^NO!LS7FFZVGnAXJRNQGVH 
P1:T9IH90BBBBV1LLE98ECT0R 

C2:KCCE5FBLG8TPLW7CKYRH 

Pg:HWE8T90F9GREEBVILLE9 

g,. In the preceding subparagraph It was stated that, even after the 
presence of the probable word PSTUIEECC was conflnsed, we arbitrarily 
assumed the crib to be In Message "A". It Is Important to note that there 
Is an element of ambiguity In reading a Baudot depth of two; If two mes- 
sages are of the same length. It Is possible to recover the entire texts 
of the messages, but the plain texts corresponding to the particular mes- 
sages might be Inverted, l.e«, the plain text recovered for Message "A” 
really belongs to Message *%", and vice versa. This phenomenon, charaeter- 
Istic of Baudot depths only. Is brou£^t about by the binary addition In- 
herent In the cryptographic process. An assurance that we have the rl^bt 

* The last 13 chaiacters of Message "A" cannot be decrypted at this time, since In these positions we do 
not have a second message tpon which to test Icey obtained from plaintext assumpuons. If diem is a systema- 
tic method for die generation of key, and if diis method is successfully analyzed, then it will be possible to 
read the "depth of one" at the end of Message "A". 
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plain text with the right cipher Is only obtained If (a) one message Is 
longer than the other (in vhleh ease the logical continuation of the longer 
messam vlU Indicate vhleh of the two plain texts belongs to the message), 
or (b) a third message Is available on vhleh to test the derived key. For 
example. If the plain texts to our two messages In the preceding subpara- 
graph had been inverted, ve vould have obtained the following result, shown 
only In part: 



5 10 50 55 60 65 70 

Key: HHXOYWFLSM 7 Y Y J 5 5 

Ci: L0A^H39bTB BN0IS7FP2VCKAXJRNQGVS 

Pi: ENSMY 9 PATR VILLS9 

C 2 : BLY77DADAG VCKYRH 

Pg: REQUEST 9 AD S 9 SECT 



The last vord In the second message, SECT(0R?), seems to have been throttled; 
unless a group is missing, this Is indicative that the plain texts of the 
messages have been Inverted. Further confirmation could be obtained If ve 
had a third message against vhicb to try our derived key. For example, let 
the third message, starting at the same point in the key as the other two, 
begin with the cipher text VLXPH ••• 1& l^lOa^ the key derived 



"Key": KHXOYWFLSM 
C 3 : YLTPH5I8Q7 
P 3 : FELZYQHLQV 

Figure liKte. 



Key: UEJARLJYMK 
C 3 : YLTPH918Q7 
F 3 : IH9REPLY9T 

Figure l40b. 



above yields gibberish, vhereas in Fig. l40b the key recovered in the pre- 
ceding subparagraph produces valid plain texb for the third message. 



h. In subpar. f ve recovered 57 elements of key, and the key did not 
repeat within this stretch. If the key Is periodic, ve vould need additional 
traffic to establish the length of the period, unless the period Is too long 
to feasible this determination. But even If the key has a long period. 
If this key has been produced by the Interaction of two short key loops, m 
vlU be able to partition the key Into Its two components and reconstruct 
two equivalent loops vith vhleh ve could generate the entire key; thus ve 
vould be able to read all messages encrypted vith these tapes 



If this diitd message were not In Audi depth wldi the other two, we could use a modification of the dia- 
gram in Fig. 139 to test die first few letten of the third message against the lecoveied key (or its complement), 
and then, if necessary, die last few letten of the third message against the key (or its conplement). 

10 

* Once we have possession of the entire key, a new message coiild he read by didlng, say, the first 10 
cipher characten of the message against the key stream, in a manner identical to that illustrated in Fig, 139. 

If the indicator system were known, or if there were a long polygraphic repetition m common with an already 
solved message, a new message could be read without furdier ado. See also pat. 98 (and, in particular, 
subpar. 982 ) in connection with die kappa test for message placement. 
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io Let us assume that the key recovered in subpar. f has been produced 
by teo short loops of unknovn lengths between 11 and 30 characters, so that 
the total key ml^t be from 350 (* 11 x 12 ) to 2^30 (*49x30) characters long. 

The first thing to be determined Is the length of the two tapes concerned. 
Uhat we will do Is write out the key successively on various widths, starting 
at a width of 11 ; aa soon as we have arrived at the correct length for one 
of the tapes, the length of the other tape trill be manifested by a process 
described belowo Consider the following transcriptions of the key on widths 
of 11 , 12 , and 13 : 



1 23456 78 9 10 11 
UBJARij^NKB 
YfiSUHXCFFLY 
A3MBXM9KB3L 
F394T3HFI7B 
GS3N78Q40HK 
R A 

Figure l4la. 



123456789 10 U 12 

OTTTXSTTTTOrT 

H8irMXCFFLYA3 

NBXM9KB3LF39 

4T3HFI7E6S3N 

78Q40HKRA 



Figure l4lb . 



1 23 45 6789 10 11 12 13 

irTTTTnrTTTTTSTTr 

8WMXCFFLYA3MB 
XH9KB3LF394T3 
HF17BGS3N78Q4 
0 H K R A 



Figure l^dc . 



Now If we take each one of the foregoing transcriptions and add the first 
row of key to the second row, the second row to the third, and so on, we 
will be negating the effect of the key, producing what amounts to a delta 
or difference stream. At the correct assumption of the length of one of 
the tapes , the delta stream will ^i)eat Itself at an Interval corresponding 
to the length of the other tape .^^ The deltas at the foregoing three wldtto 
are shown below: 



1 2 34567 89 10 U 

ffjkdtgms4v 

OQMYVVYITSO 
RNU9LOKI7QN 
WLWZK3MJBJZ 
K B 

Figure llt2a. 



12345678 9 10 11 12 
JEU73A4-HESSZ 
TBZ8IVTE8MH7 
EFBQFFlFQNdQ 
XTVDZFTHI 



Figure lll 2 b . 



1 2 3 4 5 6 7 8 9 10 11 12 13 
UF3E5540IWXFY 
XT]UF3£55401WX 
PYXT]UF3E3340I 
V X P Y X 



Figure l42c. 



It is clear from the repeated delta stream msAlfested In Fig. l42e that the 
lengths of the two tapes axe 13 and 13 characters. ~ 



Nov that we know the lengths of the tapes, we can reconstruct 
equivalent tapes which will be cryptograxdiically identical with the original 
tapes The 37 elements of recovered key are written on a width of 13 (the 

length of the shorter tape), allowing space between successive rows; and on 
this diagram every 13 characters (the length of the longer tape) are blocked 
off beneath the key. We will now arbitrarily assume that the first character 
on tape II (the longer tape) Is a since the first key character Is also 
a this would make the first element of tape I (the shorter tape) an " 8 ", 
In order to satisfy the equation Ul +82 • Uk* The "U's” are written under 

As has already been noted, in Baudot anthmetlc subtraction is identical with addition. 

See also subpar. 8£{g for an analogous situation involving addidve-encipheied monome-dinome systems. 

^ These tapes will differ from the original tapes by a constant Baudot character added to all the elements 
of each key tape. 
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the key at every cyclic repetition of tape II, and, adding these U's to 
their corresponding key letters^ ve obtain elements belonging to tape I; 
this is shown in Fig. l43a^ belov. By continuing this process, ve are able 



1 234567 8 9 10 U1213 
Tape I: 8 

Key: UEJARLJYKKBYW 
TIape II: U 

8WMXCPFLYA3MB 

]U 

XH9KB3LP394T$ 

]« 

HPI7EG83N7dQ4 

]n 

0 H K R A 



1 2 3 4 5 6 7 8 9 10 11 12 13 
Tape I: 859UELXLA9HQH 
Key: UEJARLJYNKBYU 
Tape I1:UST$H8D0IHLX0 
8WMXCPPLYA5MB 
8qJuST3H8DOTHL 

XM9KB3LP394T^ 

X 0 8 Q]U 

HPI7EGS3N78Q4 

]« 

0 H K R A 

Figure l43b. 

is shown in Fig. l43b. With 
key of 193 characters’, the 



Figure l43a. 

to reconstruct both tapes in their entirety, as 
these tapes at hand, ve can generate the entire 
first 90 of vhlch are shown belov: 



5 10 15 20 25 30 

Tape I:859UELXLA9HQH]8 59UELXLA9HQH]8$9U 
Tape II: UST5H8D0THLXO8 q10ST5H8DOTHLXO8q 1 
Key: U£JABLJYNKBYW8WM3tCPPLYA9HBXM9K 



35 40 45 50 55 60 

ELXLA9HQH]859UELXLA9HQHJ8^9UELXL 

U3T5H8D0THLX08q[]UST5H8D0THLX08qil 

B3LP394T5HPI7EGS3M78q40HK”rAYXG 



65 70 75 80 85 90 

A9HQH]8 39UELXLA9HQH]8^9UELXLA9HQ 
UST5H8D0THLX08q1uST5H8D0THLX08Q1 
5V5W88FA3RattYAHHF55T9ZIXF8BAH8 

With the key extended to the 70th position, ve are now able to read the end 
of Message "A" vhlch was previously denied to ua because the depth of two 
did not extend that far. The decryption of the last four groups of Message 
"A” is now revealed as follows 



55 60 65 70 

Key: ft40HKRAYXG5V5W88FA3R 
Cipher: N0IS7FPEVGNAXJRNQGVH 

Plain: 9SECT0R^M834BURNSIDE 



Note the appearance in the plain text of the punctuanon and of the carriage -leturn and line-feed 
functions. 



353 



REF ID : A64554 






98 . The K (kappa) test for the auperlmposltlon of messages.— ■a. In 
subpar. in conmctlon vlth a discussion on placing polyalplwbetically 
enclpbered meeagea in depth, it vas stated that "even If an extremely lox% 
key Is employed and several messages beginning at different Initial points 
are ex^iphered by such a key, tbla method of superlmposltlon can be employed, 
provided the messages can be superimposed correctly, that Is, so that the 
letters lAlch fall In one column really belong to one cipher alphabet." In 
subpar. 72^ In connection vlth a discussion on the solution of progressive 
alfdiabet systems. It vas stated that there axe three principal means of 
superimposing messages, as foUovs: (l) superlmposltlon by means of known 

Indicators; (2) superlmposltlon by ciphertext repetitions; and ( 3 ) super- 
imposition by a comparison of columnar frequency distributions. It was 
furthermore Indicated, In an accompanying footnote to subpar. 72^ that the 
foregoing three means are also applleable for the superlmposltlon of messages 
In other types of repeatlng-key systems. If the repeating key Is very long 
(or, for that matter. If the period Is undeterminable} , then ve can bring to 
bear a atatlstlcal method for placing messages In depth, even If the Indica- 
tor system Is unknown and there are no long polygraphle repetitions In com- 
mon among the messages. Tbla statistical method vUl be described In the 
subparagraphs belov. 

b. One of the most Important techniques In cryptanalytlcs Is that 
knoim'*as the "kappa test." Ihls test Is useful for several cryptanalytlc 
puirposea and one of the moat Important of them Is to ascertain when two or 
more sequences of letters are correctly superimposed. By the vord "correct- 
ly" In this case Is merely meant that the sequezices are so arranged relative 
to one another as to facilitate or make possible a solution. The test has 
for Its theoretical basis the following clrcxustanees: 

( 1 ) If any two rather lengthy sequences of letters are superimposed. 

It vlll be found, on examining both mendbers of the successive pairs of 
letters brou^t Into vertical Juxtaposition, that In a certain nuitiber of 
cases the two superimposed letters vlll coincide . If both sequences of 
letters constitute random text taken from a 2&-letter alphabet, there vlll 
be about 38 or 39 such cases of coincidence per thousand pedrs examined. 

This, of course. Is because the "kappa" or repeat rate for single letters 
(l.e., the probability of monographic coincidence) of random text Is the 
reclporocal of the numiber of elements in the alphabet; so for a 26-charMter 
alphabet the Kj. (kappa random) Is ■ . 038 $. If both sequences of letters 
constitute English plain text, there vlll be about 66 or 67 such eases of 
coincidence per thousand pairs examined. This Is because the Kp or repeat 
rate for sln^e letters of English plain text Is .0667> (The student vlll 
note that these two constants, Kp and k^, are the ones he has been using In 
the monographic 4 and tests When 26-letter text has been involved.) 

( 2 } If the superimposed sequences are wholly monoaliAiabetlc encii^r- 
ments of fdaln text by the same elj^r alphabet, there vlll still be about 
66 or 67 eases of coincidence in each 1,000 cases examined, because In mono- 
alphabetic substitution there is a fixed or unvarying relationship between 
plaintext- and ciphertext letters, so that fbr statistical purposes mono- 
alphabetic cipher text behaves Just the same as If It were normal plain text. 
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( 3 ) Bren If the tvo superiaposed sequences are not monoalphabetleally 
enelptered text^ hut are polyalphabetlc In character « there vlU still be 
about 66 or 67 cases of identity between superimposed letters per thousand 
eases examined, troylded that the two secwences really belong to the same 
cryptogganhlc system and are superimposed at the proper point with respect 
to the keying sequence . The reasons for this will be set forth In the 
succeeding subparagraphs. 

(4) Consider the two messages below. They have been enclidaered poly- 
alphabetlcally by the same two primary components sliding against each other. 
The two messages use the same keying sequence, beginning at the same Initial 
point In that sequence; that Is, they are in flush depth. Consequently, the 
two messages axe Identically enciphered, letter for letter, and the only 
differences between them are those occasioned by differences In plain text. 



No. 



No. 



r Alphabets 
1 1 Plain text 
LciT^ber 

r Alphabets 
2 ) Plain text 
(.Cipher 



16 21 13 S 6 4 17 19 21 21 2 6 3 6 13 13 1 7 12 6 
WHENINTHECOURSELONG M... 
EQHBTFYRCXXLQJNZOYAW... 

16 21 13 S 6 4 17 19 21 21 2 6 3 6 13 13 1 7 12 6 
THEGENERALABSOLUTEL Y... 
PgJ[TUFBVDJLQHYZPTMQ I... 



Bote, now, that (a) In every case in which two superimposed eliAier letters 
are the same, the plaintext letters are identical, and (b) In every ease In 
which two superimposed cipher letters are different, the plaintext letters 
are dlffezent. In such a system, even thou^ the cipher alphabet changes 
ftrom letter to letter, the number of cases of Identity or coincidence In 
the two menibers of a pair of superimposed cipher letters will still be about 
^ or 67 per thousand cases examined, because the two members of each pair 
of superimposed letters are In the same cipher alphabet and It has been seen 
In C2J ttot In monoalphabetlc cipher text k Is the same as for plain text ,5^ 
via., . 0667 . ihe two messages m^ here be said to be superimposed ^correct- 
ly," that Is, brought Into proper Juxtaposition with respect to the keying 
sequence. 



(^} But now suppose the same tvo messages are superimposed "incorrect- 
ly," that Is, they are no longer In proper Juxtaposition with respect to the 
ke^ng sequence. Thus: 



No. 1 



No. 2 



[ 

[ 



Alphabets 
Plain text 
Cipher 

Alphabets 
Plain text 
CliOier 



16 21 13 5 6 4 17 19 21 21 2 6 3 6 13 13 1 7 12 6 
WHENINTHECOURSELOhGM 
EQHBTFYRCXXLQJNZOYAW 

16 21 13 5 6 4 17 19 21 21 2 6 3 6 13 13 1 7 12 
THEGENERALABSOLUTEL 
PQNTUFBHDJLQHYZPTMQ 



Hie fact diat in this case each monoalphabet contains but two letteis does not affect the theoietlcal 
value of K ; and vitaether the actual number of coincidences agrees closely with the eiqpected number based 
upon K = .0667 depends upon the lengths of the two superimposed sequences. 
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It l 8 evident that the two members of every pair of superimposed cipher 
letters are no longer In the ssme cipher alphabet, and therefore, If two 
superimposed cipher letters are Identical tMs Is merely an "accident," 
for now there Is no basic or general cause for the similarity, such as Is 
true In the case of the correct super Imposition. The similarity, If present. 
Is, as already stated, due to chance and the number of such cases of similar- 
ity should be about the same as though the two cipher letters were drawn at 
random from random text. In which = .0385. It Is no longer true that (a) 
In every case In which two superls^sed cli^r letters are the same, the 
plaintext letters are Identical, or (b) In every ease In which two super- 
imposed cipher letters are different, the plaintext letters are different. 
Note, for example, that the superlmpMed T<.*s represent two different plain- 
text letters and that the Sp of the word COURSE In the first message gives 
Jc while the S of the word ABSOUITELf In the second message gives He* Thus, 
it becomes clear that In an Incorrect superlmposltlon two different plain- 
text letters enciphered by two different alphabets may "by chance" laroduee 
Identical cipher letters, which on superlmposltlon yield a coincidence having 
no external Indications as to dissimilarity In plaintext equivalents. Hence, 
If there are no other factors which enter Into the matter and which might 
operate to distort the results to be expected from the operation of the basic 
factor, the expected number of cases of Identical cipher letters brought to- 
gether by an Incorrect superlmposltlon will be determined by the value 

»<-r ■ .0385. 

( 6 ) But now note also that In the foregoing incorrect superlmposltlon 
there are two Ze's and that they represent the same plaintext letter L. This 
is occasioned by the fact that the pdmlntext messages happened to have L's 
In Just those two places and that the cipher alphabet happened to be the same 
both times. Hence, It becomes clear that the same cipher alphabet brought 
Into play twice may "by chance" happen to encipher the same plaintext letter 
both times, thus producing Identical cipher letters. In some systems this 
source of Identity In superimposed cipher letters Is of little Importance; 

In other systems. It may materially affect the actual number of coincidences. 
For instance. If a system Is such that It produces a long secondary keying 
cycle composed of repetitions of short primary keying cycles, an Incorrect 
superlmposltlon of two cryptograms may bring Into Juxtaposition many of these 
shOTt cycles, with the result that the actual nuidber of cases of Identical 
superimposed cipher letters Is much greater than the expected nuniber based 
upon Kx> » .0385. Thus, this source for the production of Identical cipher 
letters In an Incorrect superlmposltlon operates to Increase the number of 
cases to be expected from the fundamental constant ■ .038^. 

(7) In some systems, where nonrelated cipher ali^abets are employed. 

It may happen that two Identical plaintext letters may be enciphered by two 
different cli^ier alphabets which, "by chance", have the same equivalent for 
the plaintext letter concerned. This Is, however, a function of the partic- 
ular cryptographic system and can be taken Into account when the nature of 
the system Is known. 
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(8) In general, then, It nay be said that In the case of a correct 
superin^itlon the probability of identity or coincidence in superinposed 
cipher letters is .0^7; in the case of an incorrect superinposltlon, the 
probability is at least .0385 and nay be soneHhat greater, depending upon 
special eircunstaaees. The foregoing situation and facts neke possible vhat 
has sonetlnes been referred to as the "coincidence test." Since this test 
uses the constant k , the specific designation "kappa test" is more appro- 
priate. 



e. The vay in ubich the kappa test nay be applied viU now be ex- 
plaix^. The statenent that Kp • .0667 neans that in 1,000 cases irtiere 
tvo letters are drawn at random from a large volume of plain text, there 
will be about 66 or 67 cases in which the two letters coincide, ttot is, 
are identical. Nothing is specified as to what the two letters shall be; 
they nay be tvo Z*s or they nay be tvo £'s. This constant, .0667, really 
denotes a percentage: if nany comparisons of sincp.e letters are nade, the 
letters being drawn at random from amoz^g those constituting a large volume 
of plain text, 6.67 per cent of these comparisons nade will yield coinci- 
dences. So, if 2,000 swsh comparisons are nade, the theory indicates that 
there should be about .0667 x 2,000 ■ 133 coincidences; if there is suffi- 
cient text to permit making 20,000 cranparisons , there should be about 1,33^ 
colncldenees, and so on. 

d. Another vay of handling the matter is to find the ratio of the 
obsex^d number of coincidences to the total number of cases in which the 
event in question night possibly occur, l.e., the total number of compari- 
sons of superimposed letters. When this ratio is closer to .0667 than it is 
to .038^, the correct superlnqpositlon has been ascertained. This is true 
because in the ease of a correct superinposltlon both members of each pair 
of superinposed letters actually belong to the same nonoalidiabet and there- 
fore the probability of their coinciding is .0667; whereas in the ease of 

an incorrect superinposltlon the nendiers of each pair of superimposed letters 
belong, as a general rule, to different monoalphabets and therefore the 
probability of their coinciding is nearer to .0385 than to .0667* 

e. From the foregoing, it becomes clear that the kappa test involves 

ascertaining the total nunber of comparisons that can be made in a given 
case, as well as ascertaining the actual number of coincidences in the case 
under consideration. When only two messages are superinposed, this is easy: 
the total number of comparisons that can be made is the same as the number 
of superimposed pairs of letters. But When more than tvo messages are 
superimposed in a euperimpoaition diagram it is necessa^ to make a slnple 
calculation, based u^n tte fact tWt n letters yield pairs or eom- 

The qualifying fbrase "as a general rule’ is intended to cover any distomon in results occasioned by 
the presence of an unusual number of bote cases of coincidence described under subpars. b(6) and (7). 
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parlBons, vbere n Is the nusdber of letters In the column.^^ For eieainple, 
in the esse of a column of 3 letters, there are ■ 3 comparisons; in 

J.vO Z 

the ease of a column of a letters, there are ■ 6 comparlsoas; and so 

on. If a superlmposltlon diagram contains columns of various lengths, one 
merely adds together the nunber of comparisons for the columns of differ* 
ent lengths to obtain a grand total. 

f . In ascertaining the number of eolneldenees In the ease of a column 
eontapilng several letters. It Is again necessary to use the formula 

» only In this case n Is the n\mfl)er of Identical letters In the 

column. The reasoning, of course. Is the same as before. The total number 
of eolneldenees is the sum of the nuaiber oX coincidences for each ease of 
Identity. For exajqde, In a column consisting of the ten letters CKBKZKCBBK, 
there are 3 B^s, 2 C's, k K*s, and 1 Z. ^le 3 B'a yield 3 coincidences, the 

2 C's yield 1 eolncidenee, and the 4- K*s yield 6 coincidences. The sum 

3 ^ 1 t 6 makes a total of 10 coincidences in the ° eomqparlsonB . 

The steps In applying the foregoing principles to a typical case 
vlll now be described. Suppose several messages enciphered by the same 
keying sequence but each beginning at a different point In that sequence 
are to be solved. The Indicated method of solution Is that of superlmposl* 
tlon, the problem being to determine Just vbere the respective messages are 
to be superimposed so that the cipher text vlthin the irespectlve columns 
formed by the supeclmpoaed messages vlll be monoalphabetle. From vhat has 
been Indicated above. It vLU be understood that the various messages may 
be shifted relative to one another to siai^ different points of superlmposl* 
tlon, there being but one correct superlmposltlon for each message vlth 
respect to all the others. First, all the messages might be nunibered accord* 
Ing to their lengths, the longest being assigned the nixDDber 1. Commencing 
vlth messages 1 and 2, and keeping nund>er 1 in a fixed position, message 2 
is placed under It so that the Initial letters of the two messages coincide. 
Then the two letters forming the successive pairs of superimposed letters 
are examined and the total number of cases in which the superimposed letters 
are Identical Is noted, this giving the observed nuBd>er of coincidences. 

Next, the total number of superimposed pairs Is ascertained, and the latter 
is multiplied by .0667 to find the expected number of coincidences. If the 



^ This formula is merely a special case under the general formula for ascertaining the number of combinations 

ni 

that may be made of n different things taken r at a time, whidi is ■ In studying coincidences by 

the method indicated, since only tvio letters are compared at a time, t is always 2; hence the expression 
' r ' i(n ' r)* ' same as °^2(n^)l^^' * when (n-2)' is cancelled. 

ng 

We have already seen examples of this in subpars. 18e and 86c, in connecuon with the V test. (By 
definition, V is twice the number of coincidences. ) 
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observed minber of colneldexices is considerably below the expected nuaiber, 
or if the ratio of the observed nuadber of coincidences to the total minber 
of comparisons is nearer .0385 than to .0667« the superimposition is incor- 
rect and nessage 2 is shifted to the next super laposit ion, that is, so that 
its first letter is under the second of message 1. Again the observed num- 
ber of coincidences is ascertained and is compared with the expected nuober. 
Thus, by shifting nessage 2 one space at a tine (to the ric^t or left rela- 
tive to nessage l) the kappa test finally should indicate the proper rela- 
tive positions of the two messages. When the correct point of superimposl- 
tlon is reached, the cryptanalyst is rarely left in doubt, for the results 
are sometimes quite startling. After messages 1 and 2 have been properly 
superluqiosed, message 3 is tested first against messages 1 and 2 separately, 
and then against the same two messages conblned at their correct superlmpo- 
sltion.^*^ Thus nessage 3 le shifted a step each time until its correct po- 
sition with respect to messages 1 and 2 has been found. Then message 4 is 
taken and its proper point of superimposition with respect to messages 1, 2, 
and 3 le ascertained. The process is continued in this manner until the 
correct points of super inposltion for all the messages have been found. It 
is obvious that, as messages are added to the superimposition diagram, the 
determination of correet points of superlnposltlon for subsequent messages 
becomes progressively more certain and therefore easier. 

h. In the foregoing procedure it is noted that there is necessity for 
repeated displacement of one message against cmother or other messages. 
Therefore, it is advisable to toanscribe the messages on long strips of 
cross-section paper, Joining sections accurately if several such strips 
are necessaxy to aeconnodate a long message. Thus, a message once so tran- 
scribed can be shifted to various points of superi^position relative to 
another such nessage, without repeatedly rewriting the messages 

i. In subpar. d, above, we mentioned that in applying the kappa test 
we ffli^t consider a ratio of the observed number of coincidences to an ex- 
pected nunber. Since the statistic S I.C. is defined as the ratio ^ and 
the % I.C. is defined as we may express the value of kappa as a^al.C." 

At bst thought the student might wonder why It is advisable or necessary to test message 3 against 
messages 1 and 2 separately before testing it against the combination of messages 1 and 2. The first two 
tests, it seems to him, might be omitted and ume saved thereby. The reason for tins Is that if messages 
1 and 2 are oonecUy superimposed, it might be possible that at an Incorrect juxtaposition of message 3 
we would still get a high number of colncidencei against die combination of messages 1 and 2, whereas 
if we were to try message 3 separately against message 1 and then against message 2, our superimposition 
error would be disclosed. Thus, a correct superimposluon for one of die three combinations may yield 
such good results as to mask the bad results for the other two combinationa. 

Machinery for automatically comparing letters m applying the kappa test has been devised. Such 
machines greatly facilitate and speed up the procedure, and make possible a comparison of many messages 
among themselves whidi would otherwise require enormous labor if performed by manual methods. 
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this K i.c. vlU be defined as the ratio of the observed nuBft)er of coinci- 
dences to the expected nuBd>er of coincidences for random. The advantage 
of expressing coincidences as a a I.C. Is particularly evident when ve are 
testing digital traffic, vhereln the value of Kp for the underlying Inter- 
mediate plain text might be unknown. 

The K 2 . codstant for digital text Is of course ■ .1, and the k ^ 
for Baudot text la ^ ■ .0313; tliese are the constants to be used In deriving 

the K. I.C. for digital and teleprinter traffic. If the exact nature of 
digital Intermediate plain text Is known (such as has been indicated, for 
example. In subpars. 8^-c with respect to monome-dlnome systems), the Kp 
for a particular digital system may be calculated. As for the Kp In Baudot 
text, an analysis of 300 Western Union teleprinter messages (totalling 
53«281 characters} revealed that .0566 is the Kp for Bngllsh Baudot text.^*’ 

k. The student la again cautioned that the kappa test Is especially 
reliable only when the messages to be superimposed are rather long (say, 500 
letters or more), so that there are a sufficient number of comparisons to 
permit unequivocal manifestations of the laws of probability. If the mes- 
sages are too short, an Incorreet superlmposltlon may yield an Inordinate 
number of coincidences; or, worse yet, the correct superlmposltlon may not 
produce a hlcpi enough score. Military Cryptanalytlcs , Part III, will con- 
tain more on the kappa teat, to Include refinements applicable in certain 
polygraphlc veif^tlng systems. In the meanwhile, the student has been ex- 
posed to the basic Idea of the kappa test, to round out his general techni- 
cal perspective.^^ 

99. Fundamental principles of aperiodic aystems.— a. Virtually all 
systems based upon the principle of a repeating key can be solved because 
of cyclic or periodic phenomena, irtilch the use of a repeating key exhibits 
externally or internally in the cryptograms. There are methods for pre- 
venting the external manifestation In the cryptograms of these ;dienomena, 
or their suppression and disguise If present Internally. In soms, the 
principle Is to make the elements of a fixed or Invariable -length key apply 
to variable or irregular -length groupings of the plain text so that no 
cyclic phenomena are exhibited by the cryptograms. In others, the princi- 
ple Is to apply irregular-lengths of the key, or a variable -length key to 
regular and fixed groupings of the plain text, with the same object In view. 



Hie eiqiression "k L C. " is introduced here to eliminate the confusion whidi heretofore existed in 
designating the L C. derived from aligning two sequences, hi the past, designations sudi as ”L C. " or 
(incorrectly) " ^ I. C, " have given rise to ambiguity: liliewise, the term "kappa test" is preferable to the 
former designations "counang coincidences" or "applying the coincidence test”, which are broad expres- 
sions covering a multitude of syncracles. 

The S I. C. of English Baudot text is therefore 32(.0566) = 1.81. 

SI 

The student will be able to use the kappa test if he undertakes the analysis of some of ihe more com- 
plex cryptosystems which form a part of the traffic given in Appendix 8 
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In still other methods, both principles are coinblned, or the key itself 
is of such a nature that it does not repeat itself. This nay he brought 
about by constructing or establishing a nonrepeating key, or by employing 
the key in a special manner. Systems in vhlcb the successive letters of 
the ci^dier text (or successive letters of the plain text) after the initial 
letter serve as successive key letters are also used with the object of 
avoiding or eliminating periodicity. The subparagraphs following will be 
devoted to a description and Uscusslon of the methods of suppressing 
periodicity in cryptosystems. ^Rtese methods as a class are designated as 
aperiodic systems , as contrasted vlth the more simple periodic or repeating* 
key systems we have been studying in this text. 

b. One of the simplest methods of avoiding periodicity is to use as 
the key for the encipherment of one or more messages a series of letters or 
characters that does not repeal itself. The running text of a book, identi- 
cal copies of which are in possession of the correspondents, may serve as 
the key for this purpose. It is only necessary for the correspondents to 
agree as to the starting point of the key, or to arrange a system of indi- 
cating this starting point by means of an indicator letter or group in a 
fixed position of a cryptogram, usually at the very beginning. Various 
types of cipher alphabets may be employed In this system: direct or re- 
versed standard alphabets, mixed alphabets drawn up at random, or secondary 
alphabets resulting from the Interaction of two primary sliding components. 
Such a system is called a running-key system; other names applied to it are 
nonrepeating- . continuous-, or Indefinite -key systems. Telephone directo- 
ries, the Bible, novels, long poems, standard reference works, numerical 
tables such as logarlthmie and trigonometric tables, etc., have often been 
used as source books for such keys. 

c. In the preceding subparagraph It was shown how suppression of 
perioUcity could be accomplished by means of a continuous key. However, 
periodicity may also be avoided by special manipulation of an otherwise 
finite, repeating key. A key word, though limited in length, may never- 
theless be applied to variable or invariable -length sections of the plain 
text. When, for example, each letter of the key serves to encli^er a single 
letter of the plain text, the encipherment Is said to be Invariable or fixed 
in this respect. Ihe same Is true even if a single letter of the key serves 
to encliAier regular sets of letters of the plain text; for example, each 
letter of the key may serve to encli^er 2, 3> 4..., letters of the text. 

In these cases periodicity would be manifested externally by the cryptograms, 
provided that there Is a sufficient amount of text to be examined. But If 
each letter of the key serves to encipher Irregular or variable -length 
groupings of the plain text, then periodicity cannot appear except under 
rather remote contingencies. Suppose, for example, that so simple a scheme 
is used as letting each letter of tne key serve to encipher a complete word 
of the text; since words are of irregular lengths and there is no regularity 
whatever In the sequence of words with respect only to their lengths, peri- 
odicity cannot appear. Or, instead of enciphering according to natural word 
lengths, the Irregular groupings of the text might be regulated by other 
agreements; for example. It might be agreed that every key letter will be 
used to encipher a nuoiber of letters corresponding to the numerical value 
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of tho key letter In tbe nomal alphabet. If the key vcxrd In the fore- 
going two eye terns Is short and the message is long, periodicity nay creep 
in despite the irregular groupings in the eneiphement. Sufficient evi- 
dence may even be obtained to lead to a disclosure of the length of the 
key. But if the key consists of a long word, or of a complete lAirase or 
sentence, the text would have to be very long in order that sufficient 
evidences of periodicity be found to mske possible tbe determination of 
the length of the key. 

d. In the preceding subparagraph, periodicity was suppressed by en- 
ciphering variable-length groupings of tbe plain text . It will now be 
shown how periodicity may be avoided by enciphering by variable-length 
groupings of the key. Tbe method consists in interrupting the key; given 
a key word, it can become a variable -length key by interrupting it accord- 
ing to some preaxranged plan, so that it becomes equivalent to a series of 
keys of different lengths. Thus, the single key word QUEBTIONABUT, for 
example, mi£^t be expanded into a sequence of irregular lengths, such as 
QUraTlQNVWBSTI0NAB/«]B/qUE8Tl/, etc.^ 

(l) Various schemes for indicating or determining the interruptions 
may be adopted. For example, suppose it may be agreed that the interruption 
will take place loDedlately after and every time that the letter S occurs in 
the plain text; this is the plaintext interruptor method. If the key word 
were QDESTIOKABLf , it would then be Intenrupted as shown in the following 
example: 



K: qUBQU QUEST IQHAB QUEST QUESQ UE 
P: CURES ONTLl HESAR EBCMR EFQRT ED... 

Since this scheme is cryptographically objectionable because of a prepon- 
derance in the key of the first few letters of the key word, it might be 
advantageous to use the key interruption (in this ease, tbe presence of an 
Rp in the text being enciphered) either to cause the k^ to "stutter", or 
to skip an element in the key; these effects are shown in tbe following 
examples: 



K: QUEE8 STION AHLIQ QUEST TIONN AB 
F: CURES ONTU NESAR SNOHR EPORT ED... 

K: QUETI RAHUT QUEST ONABL QUBSI ON 

P: CURES ONTLI BSBAR ENOUR EFQRT ED... 



^ Note diet beie die key vrord is beliig inteirupted acccadlng to its denved numerical key, i. e. , first 

81139 10 4 7612 S12 
QUESTIONABLY 

after die digit 1, then after die digit 2, etc. Hie example in this subparagraph diovra how a long key sequence 
may be derived from a diort basic key. 
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(2) An alternative to the foregoing method la that employing the 
idea of a ciphertext Interruptor letter. In this ease, the Interruption 
of the key takes place every tine a designated letter shows up In the 
elidier text. 

(3) It Is possible to apply an interrupted key to variable-length 
groupings of the plain text. In Illustrating this method, an Indicator 
(for Instance, the letter X) viU be Inserted In the plain text to show 
when the Interruption takes place. For example. If the plain text Is 
polyalphabetlcally enciphered by word lengths and one letter of the key 
word QUESTIONABLY Is skipped when the Interruptor letter is used, ve would 
have the following: 



K: QUE STIQNA LYQUE STI ONAB YQUESTIO 

P: OUR FRONTX LINES ARE NOHX REFQRXBD... 

Many other variations of the Interrupted method are of course possible; 
Military Cryptana iY*-<eg, Part III, will contain more on the cryptography 
of these systems, as well aa Include detailed treatment of their crypta- 
nalysis. 

e. The last major class of aperiodic systems is that of autokey sys- 
t^ In which the key Is automatically derived either from the cipher text 
(in the case of ciphertext autokey systems) or tron the plain text (in 
Plaintext autokey systems) . 

(1) Suppose, for example, that two correspondents agree to use the 
word TRUE as an Initial key In a ciphertext autokey system. In conjunction 
with reversed standard alphabets, and the message to be enciphered begins 
HEAVY 1N1EEU)ICTI(EI FIRE FALLING AT... The first four letters are enciphered 
as foUows: 

K: TRUE 

P: HEAVY INOER BICTI ONFIR SFALL INGAT... 

C: MNUJ 

The cipher letters MNUJ now form the key letters for enciphering the next 
four plaintext letters, YINTp, yielding OFOOe* latter then form the 
key letters for enciphering the next four letters, and so on, resulting in 
the following: 

K: TOUm NUJOF HQHOB IIVWU VQQDR L06GD 

P: HEAVY INTER DICTI ONFIR EFALL INGAT... 

C: MNUJO FHQXO EIIVW UVQQD RLOSG DBHCX 

(2) Instead of using the cipher letters in sets, as shown above, the 
last cipher letter given by the use of the key word may become the key letter 
for enciphering the next plaintext letter; this new cipher resultant then 
becomes the key letter for enciphering the following letter, and so on to the 
end of the message. Thus: 
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K: TBUEJ LDQlCr CZRHf OAI71A JFAAP EtfJDA 

F: HEAVY INIER DICTI ONFIR EFALL INGAT... 

C: MNUJL DQJOX: ZRFtfO ANIAJ FAAIS WJDAH 

It is obvious that an initial Tsisy vord is not necessary; a single pre- 
arranged letter viU do. 

(3) In plaintext autokey systems, the plain text itself serves as 
the key, after an initial group or an Initial letter. This is shown in 
the following example, wherein the text of the message Itself, after the 
prearranged initial key word ^SiUE, forms the key text (the enciphering 
alphabets, as before, are reversed standard alphabets): 

K: mJEH EAVYI NIESD ICnO NFIRE FALLl 
F: HEAVY IH7ER DICTI QBFIR EFALL ISGAT... 

C: MNUJJ WHCUR KLCYV UFOAX JAIGT XNFLP 

(k) One serious objection to plaintext autokey systems is that the 
results of errors are cumulative; one error affects all the succeeding 
letters, and if several errors are made, the messages are difficult to 
decrypt. (Hils disadvantage can be minimized by the use of automatic cipher 
devices suitably constructed to accomplish the encipherment with speed and 
accuracy.) The serious weakness of ciphertext autokey systems, on the other 
hand, is that the key of an Intercepted message is already in the possession 
of the enemy cryptanalyst, since the cipher text itself is the key. How 
these syste^ ai^ solved merits detailed treatment; their cryptanalysis will 
be discussed in the next volume. 

f . There are many elementary cryptomechanisms eud cipher devices which 
have as their principle the suppression of periodicity. A description of 
some of the more Important of these is contedned in Appendix 6, "Crypto- 
graphic Supplement." 

100. Final remarks. — a. In subpars. IBf'h we stated that there are 
twelve different equations possible for estabrishlng the manner in which two 
sliding primary components may be used. It was furthermore stated that 
twelve square tables, equivalent to the twelve different equations, can 
readily be constructed. Using the two components given in the example, 

(l) ABCDEFGHIJKLMNOFQRSTUVWXYZ 

(2) FBFYRCQZIGSEHTDJUMKVALWNOX 
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and the twelve enciphering equations 



(1) 


V2 


• ®l/l: 


Vi 


• ^/2 


(7) 


^/2 


• ®p/l^ 


%/2 


• Vi 


(2) 


V2 


■ ®i/li 


®p/2 


' «c/l 


(8) 


®k/2 


■ ®c/l- 


®i/2 


• Vi 


(3) 


®k/l 


■ ®l/2' 


®P/1 


•®c/2 


(9) 


®k/l 


•®p/2‘ 


®l/l 


•»c/2 


(4) 


Vi 


■ «i/2. 


®p/2 


* ®c/l 


(10) 


®k/l 


■ ®c/2« 


®l/l 


•*p/2 


(5) 


«k/2 




®l/l 


■ ®c/2 


(11) 


®k/l 


■ ®p/2- 


®l/2 


• Vi 


(6) 


®k/2 


■ ®c/l^ 


®i/l 


• V2 


(02) 


®k/l 


■ ®c/2- 


®i/2 


■ Vi 



we can produce the corresponding twelve square tables, the first four rows 
of which are shown below: 



Table 
So. 1 



Table 
No. 2 



Table 
No. 3 



Table 
No. 4 




It Is undeRtood that the plaintext letten axe to be found m die notmal sequence above the square 
proper, the Icey letten m the sequence to die left of the square, and the resultant cipher letten within 
the square. 

^ Thu table is cryptographically Identical with that given in Fig. 9 on p. 21, even though for com- 
parison purposes die teitizontal rows of the latter have been intendianged so as to begin successive alpha- 
bets with the successive letters of the normal sequence. 
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Xable 
No. 5 



A 

B 

C 

0 



ABCDBFGHIJKLMMOPQRSTUVWXYZ 

AVKMUJDTHESGIZQCRYPBFXONWL 

BFXONWLAVKMUJBTHSSGIZQCRYP 

CRYPBFXONWLAVKHUJDTHSSGIZQ 

DTHESGIZQCRYPBFXONWLAVKMUJ 



Table 
No. 6 



A 

B 

C 

0 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 

ATPGJULIMFCZDXUSOQKHEBYVRN 

HAWNQBSPTMJGKEDZVXROLIFCYU 

LEARUFWTXQNKOIHBZBVSPMJGCY 

UNJADOFCGZWTXRQMIKEBYVSPLH 



Table 
No. 7 



A 

B 

C 

D 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 

GHIJKLMNOPQRSTUVWXYZABCDEF 

ZABCDEFGHIJKLMNOPQRSTUVWXY 

VWXYZABCDEFGHIJKLMNOPQRSTU 

MNOPQRSTUVVXYZABCDEFGEIJKL 



Table 

No. 8 



A 

B 

C 

D 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 

UVWXYZABCDEFGHIJKLMNOPQRST 

BCDEFGHIJKLMN0PQR8TUVWXYZA 

FGHIJKLMNOPQRSTUVWXYZABCDS 

OPQRSTUVWXYZABCDEFGHIJKLMN 



Table 
No. 9 



35 



A 

B 

C 

D 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

VFRTSXIEZDMAUWNBCYGHJKLOPQ 

KXYHGOZSQTUVJLWFRPIEDMANBC 

MOPEINQGCHJKDALXYBZSTUVWFR 



Table 
Ho. 10®® 



A 

B 

C 

D 



ABCDEFGKIJKLMHOPQRSTUVWXYZ 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

LPQJHBSTGUVWKOXYZCEDMAHFRI 

WYZUTPEDSMANVXFRIQHJKLOBCG 

NRIMDYHJEKLOAFBCGZTUVWXPQS 



35 An interesting fact about this case is that if the plain component u made identical with the cipher com- 
ponent (both beiqg die sequence FBPY. . . )• and if the enciphenng equauons are die same as for Table No. 1. 
then the resultant cipher square is idenucal wldi Table No. 9, except that the key letters at the left are in the 
order of the reversed mixed component, FXON. . . hi other words, the secondary cipher alphabets produced by 
the interaction of two identical mixed components are the same as those given by the mteracuon of a imxed 
component and the normal component, 

^ The foregoing footnote also applies to dils table, except diat the key letters at the left will follow the 
order of the direct mixed component. 
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Table 
No. 11 



A 

B 

C 

D 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 

GZVMPAROSLIFJDCYUWQNKHEBXT 

HAWHQBSPTMJGKEDZVXROLIFCYU 

IBXORCTQUNKHLFEAUYSPMJGDZV 

JCYPSDURVOLIMGFBXZTQNKHEAW 



TAble 
No. 12 



A 

B 

C 

D 



ABCDEFGHIJKLMNOPQRSTUVWXYZ 

FXONWLAVKMUJDTHESGIZQCRYPB 

BFXONWLAVKHUJDTHESGIZQCRYP 

PBFX0NWLAVKMUJDTHS8GIZQCRY 

YPBFXONWLAVKMUJDTHESGIZQCR 



b. When these tables are exeudned carefully, certain Interesting 
points are noted. In the first place, the tables may be paired so that 
one of a pair may serve for enciphering and the other of the pair may serve 
for deciphering, or vice versa. For example. Tables 1 and 2 bear this re- 
ciprocal relationship to each other; similarly. Tables 3 axxS. 1|-, 
and 6, 9 IQj and 11 and 12 also show this relationship. 



$ and 6, 7 
In the second 



place, althou^ the tables are derived from the same pair of componenta, 
the Internal dispositions of the letters arc quite diverse. For example. 

In Table 1 the hOTlzontal sequences are Identical vlth those of the square 
In Fig. 9 (on p. 21) , but axe merely displaced to the rl{^t and to the left 
at different Interv^s according to the stmcesslve key letters. Hence Table 
1 shovs a horizontally displaced, direct symnetry of the cipher component. 
Vertically, no symmetry Is in evidence; but vhen Table 1 Is more carefully 
examined, a latent symmetry may be discerned where at first glance It Is not 
apparent. If one takes any two columns of the table, it Is found that the 
Interval between the mendbers of any pair of letters In one column Is the 
same as the Interval between the member of the homologous pair of letters 
In the other column. If the distance Is measured on the cipher component . 

For example, consider the 2d and 13th columns (headed by L and I, Kspe?- 
tlvely) ; take the letters F and G in the 2d column, and J and W In the l^th 



column. The distance between P euad G on the cipher con^onent Is 7; the dis- 
tance between J and W on the same component Is also 7* This, of course. Is 
a manifestation of Indirect sysmetry inherent In the eii^er square. It 
follows, then, that every table which sets forth In systematic fashion the 
various secondary alpdiabets, dexdvable by sliding two primary sequences 
through all points of coincidence to find cipher equlv^ents, must show some 
kind of symmetry both horizontally and vertically. The symmrtry Is termed 
visible or direct. If the sequences of letters In the rows (or cblaimns)are 
the same throughout and are Identical with that of one of the primary com- 
ponents; It Is termed hidden or indirect If the sequences of letters in the 
rows or columns are different, apparently not related to either of the com- 
ponents, but which are In reality decimations of one of the primary compo- 



nents. 



It is Hue that the fust column within the table shows the plam-component sequence, but this is merely 
because the method of finding the equivalents m this case is such that this sequence is bound to appear in that 
column, since the successive key letters are A, B, C, ... Z, and this sequence happens to be identical widi 
the plain component in this case. The same is true of Table Nos. 5 and 11 ; it is also applicable to the first 
tow of Table Nos. 9 and 10. 
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c. When the twelve tables are examined In the light of the foregoing 
remarks, the type of symmetry found In each may be summarized In the follow- 
ing meuuier: 



Horizontal 


Verucal 


Direct 

symmetry 


hidlrcct 

symmetry 


Direct 

symmetry 


Indirect 

symmetry 



Follows Follows Follows Follows Follows Follows Follows Follows 

plain cipher plain cipher plain cipher plain cipher 

component component component component component component component 







Of these twelve types of cipher squares, corresponding to the twelve dif- 
ferent ways of using a pair of sliding primary components to derive second- 
ary alphabets, the ones best known and most often encountered in cryptologic 
studies are Tables 1 and 2, referred to as being of the Vlgen^re type; 

Tables 5 and 6, referred to as being of the Beaufort type; and Tables 9 and 
10, referred to as being of the Oelastelle type.^^ !lhe foregoing exposition 
might serve to clarify the relationships present among the twelve different 
cryptographic equations and their associated derived tables. 

d. Not much has been said In this text concerning the use of word 
separators In polyalphabetlc systems. This usage Is not often encountered 
in periodic systems; nevertheless, a few words on the subject may not be 
amiss. Word separators may be Incorporated In the cryptosystem In both en- 
ciphered and tmenclphered form, as follows: 

(l) A rare letter, such as Xp, ml^t be used as a word separator in 
the plain text of a message; this separator would then be enciphered by the 
ali^abets used in the polyalpliabetlc system. In such a case, the cipher 
equivalents of Xp, when the periodic cipher text is allocated Into Its con- 
stituent monoalphabetlc distributions, will have a predominant frequency. 39 

38 It will be noted that the tables of the Oelastelle type show no direct or visible symmetry, either horizon- 
tally or vertically, and because of this fact some authors have declared that they yield more security than do 
any of the other types of tables, this supposed increase in security is, as the student has come to leam, more 
Illusory than real. 

See footnote 8 on p. 96, Military Cryptanalytics, Part I , for the frequency characterisucs of Englidi 
plain text which includes a word separator. 
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(2) A 2$-letter cipher alphabet ndeht be used« with, aay, the letter 
Xc Bd.88liig In the cipher component; thin Ze could then be ueed ae a vord 
aeparator during the eourae of the periodic encl^teroent, vlthout dlaturblng 
the period (l*e*, aa If Xe vaa the ciphertext equivalent of a vord aeparator 
in all the alphateta). In auCh a eaae, the cvembeliiilng frequency of Xe in 
the over ■all cipher text, together vith ita charaeterlatlc poaltional appear- 
ance apaeed throughout the cipher text, vould at once proclaim vhat la going 
on. 

(3) If the Xe in aubpar. (2), above, vere Inaerted in the cipher text 
after periodic eneiphermant) it vould diaturb the cyclic phenomena that 
othezvlae might be preaent in the cryptogram, giving the Impreaeion (on 
haaty analysla) of an aperiodic ayatem. Nevesrtheleaa, aa in the preceding 
caae, the atartling Itequency of Xc in the over-all cipher text, coupled 
vith ita poaltional appearance, vould enable the cryptanalyat to interpret 
ita algnlflcanee. Once the Xe'a have been eliminated, the cryptogram vould 
be back in periodic form— vith the added help of the nov knoim vord dlvlalonai 

(4) UnenciOhered vord aeparatora need not be aa unaophlaticated aa in 
caaea (2) and (3), above. For example, in a 2$-letter alphabet vith a 
miaalng 3L, thia X^ mie^t be uaed to replace the aeeond lettara of all cipher- 
text douObleta; then the laat cipher letter of every vord la doubled, to in- 
dicate vord diviaiona. (If a vord enda in a doubled cipher letter, the 
aeeond letter of the doublet la replaced by aa Xe, fOUowed in thia caae by 
another Xe to indicate the end of a vord.) In other vorda, there vlU be 

26 different lettera uaed for vord aeperatora, in vhat appeara to be a ran- 
dom aelection. Such a caae, idien firat encountered, might be hard to dlag- 
noae becauae of poaalble mental blocka on the part of the cryptanalyat; 
nevertheleaa, the manifeatatlona of the extraordinarily high doublet rata 
in the cipher text (l6^ Inatead of the expected fhr random), the abaence 
of any tripled lettera in the cipher text, and the poaltional appearance of 
the doubleta scattered throughout the text, should be enou^ clues to enable 
the correct interpretation of these phenomena. 

(?) In polyalphabetle systema yielding digits for the cipher text, a 
particular digit, not otherwise uaed in the cryptographic adieme, might be 
reserved aa a word aeparator, which la then enciphered along with the rest 
of the text, similar to case (l), above. Or, in the case of additive-en- 
ciphered ayatems, using a monoma-dlnome system aa an example, the digit ”9" 
might be misaing in the row and column coordinates; the addition of the key 
vould be perfoxmed mod 9 (producing cipher text containing only the digits 
0 through 8). The digit 9 la then inserted in the cipher text, to show vord 
divisions, disturbing the cyclic repetltlonB of the key in the process, 
similar to ease (3), above. Such a schema micdit be troublesome, especially 
since, with a 10-element alphabet, the frequency of the digit 9 might be very 
close to the raxidom expectation of 10J(; but the absence of doubled 9'a, and 
the positional appearance of the 9*a in the cipher text, would once again 
lead to a correct interpretation of the phenomena. 




C Q HFlDHWEB a; — 



369 



REF ID : A64554 



CO MP T r BHTT ftTi 



e. The student has seen In subpsr. 97£ hov ve are able to read a depth 
of two In a Baudot systen where the key is iboger than either of the two 
■Bsaages. The reason this is possible with such a shallow depth is, of 
course, that the alphabet is a known alphabet. If our depth of two were in 
a literal systas with known alphabets (say, reversed standard alphabets) , 
solution would still be possible, regardless of the length of the total key 
or its composltlonj likewise, in a digital system, such as an additive-en- 
ciphered nonoae-dinone system, wherein the matrix and coordinates an known. 
solution of a depth of two is also possible. In certain situations, it is 
even possible to read a single message enciphered with an unknown long, non- 
repeating key, if the key is a plaintext key or is derived team, nlain text; ^o 
in effect what we really have is a depth of two in these situations, since 
a correct plaintext assumption in the message will yield plain text in the 
keyj and vice versa.^i 

f^. How that the formal part of this second volume in a comprehensive 
series of six basic texts on eryptanalyties is drawing to a close, there are 
still several topics which most be included if, as indicated at the end of 
Military Cryptanalvtics . Part 1. the first two voluaes are to contain most 
of the Mcesaary Amdaamtals of the science; this information is included 
in some of the appendices which foUow. 

(l) Althouc^ considerable treatment has been devoted to the solution 
of aonoalphabetie and polyalphSbetie substitution ciphers, we have not yet 



^ As an example of key deilved fiom plain text. coniUler an additive -endpheied monome-dlDome system 
In vAidi dte key consists of plain text taken hom a book in die possession of tbe ooneqmndenu; this key text 
la dwn oonveited Into digital fotm by endpheilng it duov^ die same matilx used for encrypting die message. 

^ Perhaps this Is as good a place as any to make some observations which ate of general interest in con- 
nection widi the runniqg-key principle, and which have no doiibt been die subject of speculation on die part 
of some students. Suppose a basic, unintelligible, random sequence of keying characters which is not derived 
from die Interaction of two or moR diorter keys and which never lepeau Is employed but once as a key for 
encipbetment. Can a ctyptogtam encipheied in such a system be solved? Tbe answer to diis question must 
unqualifiedly be this: even if the cipher alphabets ate known sequences, ctypunalytic science is oettaiidy 
powerless to attack such a ciyptogram. FurdiermoR, so far as can now be discerned, no medxid of attack is 
likely ever to be devised. Short of mediods based upon the alleged phenomena of telepathy— the very ob- 
jective existence of which is denied by most "sane" Investlgaton today— it is ImpossiUe^for die author to con- 
ceive of any way of attacklqg such a ciyptqgram. 

This Is a case (and perhaps the only case) in vAlch the Impossibility of cayptanalysis is madiematlcally 
demonstrable. Two difogs are involved in a complete solution In madwmaticts not only mutt a utisfactoiy 
(logical) answer to the problem be offered, but also it must be demonstrated that the answer offered Is unique, 
that is, the only possible one. (Tbe mistake is oftmi made dut the latter phase of what constitutes a valid 
solution is overlooked— and this Is the basic eiror which numerous alleged Bacon-Shakegieaie "cryptographers'' 
commit. ) To attempt to sidve a ciypiogram endpheted in dfe manner indicated it andogout to an attempt 
to find a unique solution for a single equation containing two unknowns, widi abtoliuely no data available for 
solution odier than those given by diat equation itself. It is obvious that no unicpie solution it possible in tucfa 
a case, since any one quantity whatsoever may be chosen for one of the unknowns and die other will follow at 
a oonsequencR. Theiefore an Infinite number of different answers, all equally valid. Is potsiUe. fit die cate 
of a cxyptogiam endibefed In the manoet Indicated, there is die equivalent of an equation with two unknowns; 
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touched upon, except for a fev remarks of a very general nature, that other 
large and Important class of ciphers, viz . . transposition . The fourth 
volume in this series will deal extensively with these latter systems; in 
the meanwhile, the stiident can learn the general methods of solution of some 
of the more elementary types of tx^sposltion systems by studying Appendix 
5, "Introduction to the solution of transposition ciphers." 

(2) In order to round out the student's beickground in the cryptography 
of codes and of certain aperiodic systems and representative machine 
cifdiers, this information is contained in Appendix 6, "CryptograiMc supple- 
ment." 

(3) In this and the preceding volume there have been numerous refer- 
ences on the Importance of the assistance rendered by machine aids in crypta- 
nalysis.^^ In modern communication intelligence operations, these aids play 

a paramount role, Just as they do in other scientific and technological fields. 
At this point in our studies, it is desirable to have an appreciation of the 
potentialities of soma of the more elementary aids, viz., punched card busi- 
ness machines; Appendix 4, "Applications of electrical tabulating equipment 
in cryptanalysis", provides this background. 

(4) Appendix 7i "Introduction to traffic analysis," will give the 
student a basic understanding of the fundamentals of this Important branch 
of cryptology, and will make him realize the close bond between crypta- 
nalysis and traffic analysis. Appendix 8, "The ZENDIAIi Problem: an exercise 



the key Is one of the unknowns, the plain text u the otlier. One may conjure up an infimte numbei of different 
plain texts and offer any one of them as a "solution. ” One may even perform the perfectly meaningless labor 
of reconstructing the "key" for this selected "solunoii", but since there is no way of proving from die cryptogram 
Itself, or from the reconstructed key (winch is unintelligible) whether the "solution" so selected !s^ actual 
plain text, all of the infimte number of "solutions” are equally valid. Now since it is inherent in the very idea 
of cryptography as a practical art that there must and can be only one actual solution (or plain text), and since 
none of this infimte number of different solutions can be proved to be the one and only correct solution, there- 
fore, our common sense rejects them one and all, and it may be said diat a cryptogram enciphered in the man- 
ner indicated is absolutely Impossible to solve. 

It is perhaps unnecessary to point out diat the foregoing statement is no loi^ger true when the running key 
constitutes Intelligible text, or if it is used to encipher more than one message, or if it is tlie secondary result- 
ant of the intetacaon of two or mote diort primary keys which go through cycles themselves. For in these cases 
there is additional mformation available for the delimitation of one of the pau of unknowns, and hence a 
unique solution becomes possible. 

Now although a true "one-tune" system represents the ultimate goal of cryptographic security and s the 
ideal toward which cryptographic experts have striven for a long time, there is a wide abyss to be bridged 
between the recogmtion of a theoretically perfect system and its establidiment as a practical means of secret 
intercommumcation. For the mere mechanical details involved in the production, reproduction, and distri- 
buuon of such keys present difficulties which are so formidable as to destroy the effectiveness of the method 
as a system of secret intercommumcation suitable for groups of correspondents engaged in a voluminous ex- 
chaiige of messages. 

^ Elementary principles of code solution have in effect been touched upon in the discussion on cryptosys- 
tems employing syllabary squares and code charts, in par. 80 of Military Cryptanalytics, Parti . 

^ Cf. the first reference on machine aids in subpar. 2£(6), Military Cryptanalyucs, Part I . 
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in communication intelligence operations," presents a simulated operational 
situation involving traffic analysis and cryptanalysis on a volume of 
traffic intercepted during a hypothetical amphibious operation. 

g. As was the case vlth the previous text, mere reading of the methods 
of solution of the various types of cryptosystems covered in this volume is 
not enou(^ to Insxu^ complete understanding of the principles and techniques 
presented. It is therefore strongly recommended that the student solve the 
problems contained in Appendix 9> "Problems - Military Cryptanalytics , Part 
II", as a means of acquiring facility and adroitness in the solution of peri- 
odic polyalphabetic ciphers. For further study, the messages of the Zendian 
Problem vill provide valuable experience in attrcking unknoim cryptosystems 
of all classes, especially as regards cryptanalytlc diagnosis. 

h. The formal portion of this text vlU be closed with a synoptic 
chart~of cryptography (continuing the series of charts established in the 
first volixme), foiml on p. 373; showing the relationships among the various 
cryptosystems treated in Military Cryptanalytics. Part II . This chart is a 
continuation of the chart on p. 227 of Military Cryptanalytics. Part I. if 
ve consider the present chart as an amplification of the box labelled 
"Polyalphabetic" in the previous chart. 

* « * * « 
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APPENDIX 1 

GLOSSARY FOR MILITARY GRYPTANALYTICS, PART II 

This glossary Is limited in scope to cryptologle terms actually 
appearing In this text, terms likely to he encountered In other crypto* 
l^lc literature of approximately the same level as this text, and a 
few other terms considered necessary to ooDpIement or to clarify cer- 
tain definitions. 
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GLOSSAIff FOR MILIIARY GRrPTANALYTICS, PART II 



accidental repetition . A repetition produced fortxiltously, and not by 
enclptaennent of Identic al pl aintext characters by Identical keying 
elements. Cf. CAUSAL REPETITION. 

additive, n. A single digits a numerical group, or a series of digits 
vhlch for tbe purpose of encipherment. Is added to a numerical cipher 
unit, code group, or plain text, usually by cryptographic arithmetic. 

additive book. A book conqxrlslng a group of additive tables. 

additive method. The method of encipherment vbereln the cryptographic 
equations are P •«' K ■ C, and P « C - K. Cf. MINUEND MBTSDD and SUB- 
TRACTIVE METISE). 

additive system. A cryptosystem In vhlch enclphexnent Is accomplished 
throu£^ the application of additives. 

additive table. A tabular arrangement of additives. 

anagram, n. Plain language reconstructed from a transposition cipher by 
restoring the letters of the cipher text to their original order.— 

V. t. To cxyptanalyze a transposition cipher in whole or in part by 
combining one series of characters with another series from the same 
message to produce plain text, plain coda, or intermediate pled.n text. 

analytical machine technique . In the solution of a cryptologic problem, 
an approach using data processlxig machinery, computers, or special 
purpose hlc^-speed electrical or electronic devices. 

aperiodic . adj. Characterised by absence of cyclic attributes or wage, 
as of key In an aperiodic system, q. v. 

aperiodic system . A system In which the method of keying results In the 
suppression of cyclical phenomena In the cryptographic text. 

autoencipherment . n. Encipherment by means of an autokey system, q. v. 

autokey system. An aperiodic substitution system In vhlch the key, fol- 
lowing the application of a previously arranged initial key. Is gener- 
ated from elements of the plain or cipher text of the message. 

ban, n. A fundamental scoring unit for the odds on, or the probability 
of, one of a series of hypotheses. In order that multiplication may 
be replaced by addition, the ban Is expressed In logarithms. 
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baud, n. !Ehe unit impulse of tbe code employed. Normally tbe inq^ulse of 
shortest duration vhleh can appear alone In a given telegraphic system, 
e.g., the dot In the Morse code, the Impulse of teleprinter systems. 

Baudot alnhabet. A five-unit code applied to teleprinter systems by Jean 
Maurice lUle Baudot (1845-1903)* It employs a 32-element alphabet 
designed particularly for talecoanunlcatlons wherein each syidbol In- 
tended for transmission la represented by a unique anangement of five 
mark or space imp MTAaa. q. v. 

Beaufort system. In cryptology, a polyalphabetic substitution system em- 
ploying a key word In connection with a Vlgemre square, but differing 
trcm the normal Vlgenwe mathod In Its rules for application of the key. 

hlllteral. adj. Of or pertaining only to cryptosystems, cipher alphabets, 
and frequency distributions which Involve cipher units of two letters or 
characters. See the more Incliislve term DI(2<AFHIC; see also BIUTBEtAL 
EREQEUEHCX DI33BIBUTIQN. 

hlllteral alidiabet . A cipher alphabet having a cl^ier coa^onent composed 
of two-character units. 

hlllteral frequency distribution . A frequency distribution of pairs formed 
by combining successive letters or chasntcters. lihus, a hlllteral dis- 
tribution of ABCDEF would list the ft^owlng pairs: AB, BC, CD, DE, EF. 
Cf . DIGBAPHIC FREQUENCY DIS1SIBUXIQN. 

bipartite alphabet. A multiliteral alphabet in which the cipher units may 
be divided Into two separate parts whose functions are clearly defined, 
e.g., row indicators and column Indicators of a matrix. 

bipartite system. A substitution system Involving the use of a bipartite 
alphabet. 

blank expectation test. Cf . LAMBDA ZEST. 

book cipher . A cipher system, utilizing any agreed-upon book, in which the 
cipher Identifies a plain element present In the book. 

bust message. A message or set of related messages containing an error In 
encipherment or violating standard cryptographic security practices so 
as to Jeoperdlze the security of the message or the system and thus be 
of potential value to the cxyptanalyst. 

call sign. Any conblnatlon of letters, nunbers, or a coaiblnatlon of both, 
used as the Identification for a ccnmunicatlons fSelU^, commai:id, au- 
thority, activity, or unit; used for establishing and maintaining com- 
munications. In U.S. military practice used also fbr the purpose of 
Identifying message originators and addxasseea. 
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callsign, adj. Of or pertaining to a call sign or call signs; as, the 
callsign generation. 

causal Isoaorph . An isomorph produced by different enclpheruants of 
Identical plain text. 

causal repetition . A repetition produced by the enelpberment of Identi- 
cal plaintext characters by Identical keying elements. Cf. ACCIDENTAL 
REPEHTION. 

cell, n. An IndlTldual small square on eross-sectira paper, grilles, etc. 

eentlban . n. A scoring unit for probability equal to one one-hundredth of 
a ban, q. ▼. A logarithm multiplied by 100. 

chain, n. In Its cryptologic application, a series, usually cyclic, of 
letters or other textual symbols foUovlng one another according to 
some rule or law.— v. t. To form Into chains. 

chi-square (x.^) table . A mathematical table listing the probabilities of 
occurrence by chance of a chi-square value higher than those observed 
In a given ease; an adjimct to the chi-square test . 

chi-square (x teat . A mathematical means for determining the relative 
likelihood that two distributions derive from the same source. For 
example, the test can be used to aid in the determLnatian of whether a 
distribution Is more likely to be random than not; In this usage, the 
observed distribution Is compared with a theoretical distribution repre- 
senting that which Is expected for randan. The end result of the test 
Is a value representing the discrepancy between the two distributions 
which have been compared. Ibis value, called a "chi-square value" may 
be Interpreted as It Is, or It may be interpreted throuc^ the use of a 
chi-square table . 

chi (X ) test . A test applied to the distributions of the elements of two 
cipher texts either to determine whether the distributions are the result 
of encl^ierment by identical ciidwr alphabets, or to determine whether 
the underlying cipher alphabets are related. Also called the cross- 
product sum . 

clfrarlo mill tare tascabile . "Pocket military cipher", an Italian World 
War 1 cryptosystem Involving a Vigenhre table with a 36-element cipher 
component consisting of the dlnomes 10-4^ In normal order. 

cipher, n. 1. A cipher system. 2. A cryptogram produced by a cipher 
system.— adJ. Pertaining to that which enciphers or is enciphered. 

See also CIPHER TESCT. 



- CO MFIDiaiTlAL 



381 



REF ID : A64554 



g ONFIDHNTIAL 



cipher alphabet. An ordered arrangement of the letters (or other con- 
ventional Blgna, or both) of a vrltten language and of the characters 
which replace them in a cryptographic process of substitution. Also 
called a substitution alidiabet . 

cipher component . The sequence of a cipher alphabet containing the symibols 
which replace the plaintext symbols in the process of substitution. 

cipher device. A relatively simple mechanical contrivance for encipher- 
ment and deci^ierment, usually hand-operated or manipulated by the 
fingers, such as sliding strips or rotating disks. 

cipher disk . A eiidier device consisting of two or more concentric disks, 
each bearing on its periphery one component of a cipher alphabet. 

cipher machine. A relatively complex apparatus or mBchanlsm for encipher- 
ment and decipherment, usually equipped with a keyboard and often re- 
quiring an external power source. 

cipher square . An orderly arrangement or collection of sequences set 

forth in a rectangular form, eomaonly a square (e.g., a Vlgenim square), 
and employed in a cipher system. 

cipher system. Any cryptosystem in which cryptographic treatment is applied 
to plaintext units of regular length, usually isonographie or digraphie. 

Cf . CODE STBTQi. 

ciiAier text . The text of a cryptogram which has been produced by iseans of 
a cipher system. 

clTdiertext. adj. Of or pertaining to the encrypted text produced by a 

cipher system or to the elements which comprise such text; as the cipher- 
text distribution. Often shortened to cipher. 

ciphertext autokey system . An aperiodic substitution system in which the 
key, following the application of a previously arranged initial key, is 
generated from elements of the cipher text of the message* 

cliAiertext Interruptor . In certain aperiodic substitution systems, a spe- 
cific cipher letter which, by prearrongement, serves to Interrupt the 
keying cycle and thus suppresses periodicity. 

code, n. 1 . A code system, q. v. 2 . A code book, q. v. 3* A system of 
signals used in electrical or electronic communication.— adj. Fertcdning 
to that which encodes or is encoded. 

code book . A book or document used in a code system, arraxtged in systematic 
form, containing units of plain text of varying length (letters, sylla- 
bles, words, phrases, or sentences) each accompanied by one or more arbi- 
trary groups of syuhols used as equivalents in messages.— adJ. Codebobk. 
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code chart . A chart in the fom of a natrlz containing letters, syllables, 
nunftMTS, vords, and occasionally, phrases. The matrix has row and 
eoluma coordinates fbr the purpose of designating the plaintext elements 
within. 

code group . A group of letters or numbers, or a combination of both, as- 
signed (in a code system) to represent a plaintext element. 

code message . A cryptogram produced by encodement. 

code system. A czyptosystem in which arbitrary groups of symibols repre- 
sent plaintext units of varying length, usually syllables, whole words, 
phrases, and sentences. 

code text . The text of a cryptogram which has been produced by means of a 
code system. 

coincidence . n. A recurrence of textual elements (sln£p« letters, digits, 
digraphs, etc.) occurring within a message or between messages. 

coincidence test . The kappa test, a statistical test applied to two cipher- 
text messages to determlna whether or not they both Involve encipherment 
by the same sequence of cipher alphabets. 

column equating . The process of reduction to monoalphabetic terms of an 
aarray of columns of additive-enciphered intermediate plain text, where 
each different column represents motioalphabetic encipherments by a unique 
additive. 

columnar transposition . A method of transposition in which the cipher text 
is obtained by inscribing the plain text into a matrix in any way exee^ 
vertically and then transcribing the eolumns of the matrix. 

comnon logarithms . Logarithms to the bue 10. Also known as Briggsian 
logarithms. 

communication intelligence . Information derived firom the study of inter- 
cepted communications. Abbr. COKDIT. 

c^Tiwmmtcatlon security . Sie protection resulting firom all measures designed 
to deny to iinauthorlzed persons Information of value which mle^t be de- 
rived Aram a study of comminlcations. Cryptosecurity and transmission 
security are the coiqponents of comiunlcatlon security. Abbr. C0M5BC. 

commutative, adj. As applied to cipher matrices, so constructed as to per- 
mit coordinates to be read in either row-column or column-row order with- 
out cryptographic ambiguity. 

complementary key . Key elements which differ from a derived or true key by 
their complemsnts, mod n^; e.g., 1^4 is complementary to 9586 , mod 10. 

complementary plain text. Intermediate plain text which differs Aram a 
derived or true plain text by the complements, mod n. 
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component . n. 1. One of the two sequences (plain and cipher) which com- 
pose a cipher alphabet* 2. An Independent or semi -Independent part of 
a machine or device. 

compromise , n. ^e availability of classified material to unauthorised 
persons through loss, theft, capture, recovery by salvage, defections 
of individuals, unauthorized viewing, or any other idiyslcal means. 

computer . n. A machine for executing prescribed programs, especially a 
high-speed automatically sequenced machine. 

continuity, n. Identity with respect to a series of changes. In cryptana- 
lytic procedure, the maintenance of continuity involves keeping current 
a systematic record of changes in such variable elements as indicators, 
keys, discriminants, code books, etc., on a given cryptochannel. In 
traffic analysis, the maintenance of continuity involves the tracing of 
changes In call signs, frequencies, schedules, or other variable ele- 
ments assigned to a given radio station, link, or net. 

crib, n. 1. Plain text assumed or known to be present in a cryptogram. 

2. Keys kxunm or assumed to have been used in a cryptogram. —v. t. 1. Tb 
fit assumed or known plain text or keys into the proper position in an 
encrypted message. 2. In traffic analysis, to equate an unknown element, 
particularly call signs and addresses, to one that is already known, 
especially applicable in case of compromise. 

cross I.C. The ratio of the observed value of a cross-product sum to that 
expected for random. Abbr. ^ I.C. 

cross-product sum. See CHI TEST. 

crypt-, crypto-. In general, a combining form meaning "hidden,” "covered," 
OT "secret." Used as a prefix in compound words, crypt-, crypto-, per- 
tains to cryptologic . cryptographic . or crypteuMlytle . depending upon 
the use of the particular word as defined. 

erypt«"«*i ysla . n. Ihe analysis of encrypted messages; the steps or pro- 
cesses involved in converting encrypted messages into plain text with- 
out initial knowledge of the key employed in the encryption. Abbr. C/A. 

cryptanalyst, n. A person versed in the art of cryptanalysis. 

cryptanalybic . adj. Of, pertaining to, or used in eryptanalytlcs. 

cryptanaljrtlea . n. That branch of cryptology which deeds with the princi- 
ples, methods, and means employed in the solution or analysis of crypto- 
systems . 

eryptamtiyze. v. t. To solve by cryptanalysiB. 

cryptochannel . n. A comj^ete system for encrypted conmunlcatlons between 
two or more holders. 
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cryptogram, n. A connunicatloD in visible writing which conveys no Intel- 
ligible meaning In any known language, or which conveys some meaning 
other than the real meaning. 

cryptographic . adj. Of, pertaining to, or concerned with cryptography. 

cryptographic ambiguity. Uncertainty as to the method of decryption or 
as to the meaning Intended after decryption; created by a fault In the 
structure of a cryptosystem. 

cryptographic arithmetic . The method of modular arithmetic used In crypto- 
graphic procedures which Involves no carrying in addition and no borrow- 
ing In subtraction. 

cryptographic depth . See DEPTH. 

cryptographic egtiatlon. In cryptosystems Involving sliding primary com- 
ponents, the rules determining the derivation of plaintext or ciphertext 
equivalents In encryption and decryption. 

cryptographic seciarlty . See CSDTPTOSBCURlTf . 

cryptographic system . See CRYPTOSYSTEM. 

cryptograidilc text. Encrypted text; the text of a cryptogram. 

cryptography, n. That branch of cryptology which treats of the means, 
methods, and apparatus for converting or transforming plaintext mes- 
sages Into cryptograms, and for reconverting the cryptograms Into their 
original plaintext form by a simple reversal of the steps used In their 
transformation . 

cryptollngulstlcB . n. flhe study of those characteristics of languages which 
have some particular application In cryptology, (e.g., frequency data, 
word patterns, unusxial or Impossible letter combinations, etc.). 

cryptologic . adJ. Of, pertaining to, or concerned with cryptology. 

cryptology, n. That branch of knowledge which treats of hidden, disguised, 
or encrypted communications. It embraces all means and methods of pro- 
ducing communication intelligence and maintaining comnunlcation security; 
for example, cryptology includes cryptography, cryptanalytlcs, traffic 
analysis, interception, specialized linguistic processing, secret Inks, 
etc. 

cryptomaterlal . n. All documents, devices, and machines employed In en- 
crypting and decrypting messages. 

cryptomathematlelan , n. One versed In cryptomathematics. 
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cryptomathematlca , n. Those portions of osthenatics and those mathemati- 
cal methods vhleh have cryptologic applications. 

cryptoperlod. n. The specific length of time throu^^out irtilch there Is 
no change in cryptographic procedure (keys, codes, etc.). 

cryptosecurlty . n. That component of coiammication security which results 
fjrom the provision of technically sound cryptographic systems and from 
their proper use. 

cryptosystem, n. The associated Items of cryptomaterial and the methods 
and rules by which these items are used as a unit to provide a single 
means of encryption and decryption. A cryptosystem embraces the general 
cryptosystem and the specific keys essential to the employment of the 
general cryptosystem. 

cyclic, adj. Periodic; continuing or repeating so that the first term of 
a series foUows the last; characterised by a ring or closed-chain for- 
mation. 

cyclic additive . A sequence of key digits used as a repeating additive. 

eyclic permutation. Any rearrangement of a sequence of elements which 
merely Involves shifting all the elements of comDon dlstaxice to the 
right or left of their Initial positions In the sequence, the relative 
order remaining undisturbed; sxich a rearrangement requires that one con- 
sider the basic sequence as being circular In nature so that, for exam- 
ple, shifting that element which occupies the left -most position In the 
sequence one place to the left places this element In the right-most 
position. 

cyclic phenomena . Periodic ciphertext repetitions in a cryptogram en- 
clidiered with a repeating key. 

Sally keying element, lhat part of the specific key that changes at pre- 
determined Intervals, usuklly dally. 

declban. n. A scoring unit for probability factors equal to one-tenth of 
a ban, q. v. A logarithm moltiplled by 10. 

Saoiniata d alphabet. An alphabet produced by decimation . q. v. 

decimation, n. The process of selecting members of a series by counting 
off at an arbitrary Interval, the original series being treated as 
eyclic; or the result of the foregoing process. 

deci»»»tlon-wri*ad sequence. A mixed sequence produced by dee<mRt.inn. q. y. 

decipher, v. t. Tb convert an enclpdiered message into Its equivalent pled.n 
text by a reversal of the cryptographic process used in the encipherment. 
(This does not Include solution by cryptamalysls.) 
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deciphering alphabet. A cipher alidiabet In vhlch the sequence of synOiolB 
In the cipher component la arranged In normal order for convenience In 
declidierment. 

decl-pherlng equation . In cryptosystems Involving sliding primary components, 
the rules determining the derivation of plaintext equlv^ents of cipher 
elements. 

declidienBent . n. 1. The process of deciphering. 2. The plain text of a 
deciphered cryptogram. 3* la an enciphered code system, the code text 
resulting ftrom the removal of the encipherment. 

decode, n. 1. That section of a code book In vhlch the code groups are In 
alidiabetlcal, numerical, or otiier systematic order. 2. Ihe decoded, but 
not translated, version of a code message.— v. t. To convert an encoded 
message into its plain text by means of a code book. (This does not in- 
clude solution by cryptanalysis.) 

decodement, n. 1. The process of decoding. 2. The decoded, but not trans- 
lated, version of a cryptogram. 

decrypt, n. A decrypted, but not translated, message.— v. t. To transform 
an encrypted eonaunlcatloEi into an Intelligible one by a reversal of the 
cryptographic process used In encryption. (This does not include solu- 
tion by cryptanalysis.) 

decryption, n. The act of decrypting. 

degarble, v. t. To make emendatioxis In a garbled text. 

Delastelle system. In cryptology, a polyalpbabetlc substitution system 
employing a key vord In connection vlth a Vlgenwe square, but differing 
tvcm. the normal Vlgenere method in Its rules for application of the key. 

delta, n. Lateral differences either of consecutive elements of text, or 
of textual elements at a constant interval apart, v. t. To derive lat- 
eral differences of a text. 

delta (^ ) I.C. The ratio of the observed number of coincidences to that 
expected for random; the Index of coincidence applied to a small sample. 
See INDEX OP COINCIDEarcE. 

delta stream . ^Rie stream derived by taking lateral differences of a text. 

depth, n. 1. The condition vhlch results vhen two or more sequences of en- 
crypted text have been correctly superimposed vlth reference to the keying 
thereof. Sequences so superimposed are said to be in depth. 2. The num- 
ber of such superimposed sequences, as a depth of three. 

depth reading . The cryptanalysis of messages In cryptographic depth. 
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derived nunerleal key . A key produced by asslgniDg ntmerlcal values to a 
selected literal key. 

diagnosis . n. In cryptanalysis, a systematic examination of cryptograas 
with a vlev to discovering the general system underlying these crypto- 
grams. 

dlgrarti. n. A pair of letters. 

dlgraiflilc . adj. Of or pertaining to any conibinatlon of tvo eharacters. 

dlgraphlc frecrueney distribution. A fjrequency distribution of successive 
pairs of letters or characters. A dlgraidile distribution of ABCDEP 
vould list the pairs: AB, CD, EF. Cf. BILIIERAL FREQUENCY DISHSUBUnON. 

digraphlc substitution. Enelidiement by substitution methods In which the 
plaintext units are pairs of characters and their cipher equivalents 
usually consist of two characters. 

dlnome. n. A pair of digits. 

direct standard clTdier alphabet . A clidier alfthabet In iriileh both the plain 
and cipher camponents are the normal sequence, the two components being 
Juxtaposed In any of the nonerashlng placements. Cf. REVERSED STANDARD 
CIPHER ALPHABET. 

direct synmetry . A property of a cipher square In which the sequence of 
eharacters In the rows or the columns Is the same throufdiout and is 
visibly Identical with that of one of the primary components, (l.e., 
patent synraatry as opposed to the latent symmetry of a cipher square 
exhibiting Indirect symnetry). 

dlserlmlnaat . n. A group of symbols Indicating the specific cryptosystem 
used In encrypting a given message. Also called system Indicator . 

distribution, n. See FREqUBICY DIS!QlIBUnON. 

dou^et. n. A digraph or dlnone In which a letter or a digit Is repeated 
(e.'g.. Us, EE, 22, 66, etc.}. 

double transposition . A cryptosystem In which the characters of a first 
or primary transposition are subjected to a second transposition. 

encipher . v. t. To convert a plaintext message Into unintelligible lan- 
guage or signals by means of a cipher system. 

enciphered code . A cryptogra^lc system in which a cipher system is 
applied to encoded text. 
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enciphering alphabet. A cipher alphabet In vhlch the sequence of letters 
In the plain component Is arranged In normal order for convenience In 
enelphement* 

enciphering equation. In cryptosystems Involving sliding primary components 
the rules determining the derivation of ciphertext equivalents of plain- 
text elements. 

encliflierment. n. 1. The process of enciphering. 2. Text vhlch has been 
enciphered. 

encode, n. That section of a code book In which the plaintext equivalents 
of the code groups are In alphabetical, numarleeLL, or other systematic 
order.-- V. t. To convert a plaintext message Into unintelligible lan- 
guage by means of a code book. 

encodement. n. 1. The act or process of encrypting plain text with a code 
system. 2. The text produced by encoding plain text. 

encrypt, v. t. To convert a plaintext message Into unintelligible language 
or signals by means of a cryptosystem. 

encrypted text. The text produced by the application of a cryptosystem to 
a plaintext message. 

encryption, n. 1. The act of encrypting. 2. Encrypted text. 

equivalent primary component . A sequence vhlch has been or can be devel- 
oped ft:om the original sequence, or basic primsry component, by applying 
a decimation process to the latter. 

factoring, n. 1. An arithmetical process of determining the period of a 
periodic polyalphabetic cl{her a study of the intervals between repe- 
titions. 2. In transposition, the process of determining column lengths 
by studying Intervals between elements. 

flat, adj. As a diaraeterlstle of a ficmquency distribution. Implies statis- 
tically not rough. Cf. SMOOTHNESS. 

flush depth. 1. The condition which results when two or more encrypted mes- 
sages have been correctly superimposed, each starting at the same point 
In the key. 2. The nuiaber of such superimposed sequences, as a flush 
depth of three. 

flractlonatlon, n. A cxyptographlc system In which plaintext units are 
represented by two or more cipher synbols which In turn are dissociated 
and siibjected to further encliherment by substitution or transposition 
or both. 
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fireouBney. n. In cryptology, tiie nuaber at actual occurrences of a textual 
element vlthln a given text. Cf. RSLA!TIVS SBBqUENCZ. 

flreouency dlstrllmtlon. A tabulation of the frequency of occurrence of 
plaintext, ciphertext, or codetext unite in a meBsage or a group of aea- 
sages. A ficeqiueney count. 

flreoueney veiriit . A weight eatebliahed for a key, plaintext, or clpbartext 
element on the basla of its arithmetical fireguency. 

BSiBBia ( Y ) l.C. Index of coincidence applied to a universe, l.e., a very 
large sample. See INDEX OF COINCISSiCE. 

garble, n. An error in tranamlaalon, reception, encryption, or decryption 
which renders Incorrect or undeerjptahle a meaaage or transmisBlon or a 
portion thereof.— ▼. t. To make an error in tranamlBalon, reception, 
encryption, or decryption of a message. 

general eryptoavaten. The basic Invariable method of encryption of a crypto* 
ayatem, excluding the specific keys essential to its employment. 

general solution. A solution dependent on exploiting the Inherent veakneasea 
of the eryptograi^e system arising firom its cwn me<dianics, without the 
preaenee of any speelallaed elrcumatancaa. 

general ayatem. See GENEEtAL CRIFTQSXSIIBI. 

gen^trix. n. 1. One decipherment or encipherment out of a set of decl- 
piierm^a or eneiphermente of the same text, the aet being eathaustive on 
a given hypotheala or given cryptographic principle. The elements of a 
generatrix are at a constant alphabetic (normal or cipher) Interval from 
those of another generatrix of the set, (e.g., as in a atrip ayatem) • 

2. In connection with the method of com^ting the plain component ae- 
guence, any one of the rova, each of which repreaenta a trial "decipher- 
ment” of the original cryptogram. 

grid, n. In a tranapoaltlon system, a form or matrix over which a grille 
is placed for the purpose of enciphering or deciphering. 

grille, n. 1. A sheet of paper, cardboard, thin metal, plastic, or like 
material in which perforations have been made for the uncovering of 
spaces in which textual units or key may be written or read on a grid. 

2. A matrix in which certain squares are blocked out or otherwise marked 
so as not to be used. Also called a stencil . 

Gronsfeld system. A pdyalphabetle substitution system employing the first 
10 ali^bets of a direct standard Vlgenere table in conjunction with a 
numerical key. The cipher equivalent of a given plaintext letter is 
found by counting down the normal sequence the nuinber of positions in- 
dicated by the numerical key; thus Ap with key of 4 is E^. 
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group, n. 1. A nuinber of digits, letters, or ehsracters forming a unit 
for transmission or for eryptographle tsreatment, 2. In radio, one or 
moare links whose stations work together as a eoasunleation entity under 
a eonmon operating control. 

high -echelon, add. Pertaining to organisational units at the anqy dlwl- 
sional level or higher, or their equivalents in other Services. 

high-grade, adj . Pertaining to a cryptosystem which offers a maxlnum of 
resistance to cryptanalysis; for example: (l) complex cipher machines, 

(2) one-time systems, (3) two-part codes enciphered with an additive 
book. Cf. L0tf-G«ADB and NEDZUM-(StAl>8. 

I.C. Index of coincidence, q. v. 

identification . n. 1. In cryptanalysis, determination of the plaintext 
value of a cipher element or code group. 2. In traffic analysis, deter- 
mination of the specific unit, aircraft, ship, or Order of Battle in- 
volved in a given instance, but not its location. 

identify. V. t. 1. In cryptanalysis, to determine the plaintext value of 
a cipher element or code group. 2. In traffic analysis, to determine 
the specific unit, aircraft, ship, or Order of Battle Involved in a 
given instance, but not its location. 

Idiomorph. n. A plaintext, cipher, or key sequence which contains or shows 
a pattern in its construction as reg^ards the nunber and positions of re- 
peated elements. 

Idlomorphlc . adJ. Sidilbltlng the phenomenon of Idiomorphlsm. 

idiomorphism. n. In a plaintext, cipher, or key sequence, the phenomenon 
of showing a pattern as regards the nuinber and positions of repeated 
letters. 

index letter. !Ehat letter of a component of a cipher alphabet against which 
the key letter in the other compcment is Juxtaposed. 

index of coincidence . She ratio of the observed nuniber of coincidences in 
a given body of text or keys to the nundier of coincidences expected in a 
sample of random text of the same size. Commonly known as I.C. See also 
nSLTA ( S ) I.C. and GAMMA ( y ) I.C. 

indicator, n. In cryptography, an element Inserted within the text or 
heading of a message lAich serves as a guide to the selection or deri- 
vation and application of the correct system and key for the prompt de- 
cryption of the message. See also the more precise terms DISCRIMIIIART 
and MBBSAOE UJDICATQR. 
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Indirect syiMBtry. A property of a elpiber square in which a pair of rows 
or pair of cdunna ney be united to give a decination at one of the 
prinary conponentB; i.e., latent syauetry as opposed to the patent sjrm- 
oetry of a cipher square e:±ibiting direct syanetry* Cf. DIRECT SXMMB3SU. 

initial key* In autokey systeas, the key elensnt or elenents lAiich are used 
to encipher the beginning of a oessage before autokeying takes place. 

inscription, n. 1. In a transposition system, the process of writing a mes- 
sage into a matrix. 2. The process cf writing a series of nuabers, let- 
ters, or coded meanings into a code chart or table. 

intelligence . n. The product resulting firom the collecting and processing 
of information concerning actual and potential situations and conditions 
relating to foreign activitieB and to foreign or eneiqr-held areas. This 
processing includes the evaluation and collation of the infoonnation ob- 
tained from all available sources, and the ajialysis, synthesis axid inter- 
pretation thereof for svibsequent presentation and dissemLnation. 

intercept, n. A copy of a message obtained by interception.-- v. t. To en- 
gage in interception. 

interception, n. The process of gaining possession of conmunicationa in- 
tended fbr others without obtaining the consent of the addressees and 
ordinarily without delaying or preventing the transmission of the com- 
munications to those addressees. 

intermediate plain text. Slain text enciibered by elements of a multiliteral 
Bubstltutim Csueh as that produced by a dlnone matrix or a monome-dinome 
matrix), which "Intemsdiate plain text" is then sidsjected to further en- 
cipherment. 

internal text. In concealment systems, the secret text which is enveloped 
by open or apparently innocent text. 

interrelated cipher alphabets. Cipher alphabets most comonly produced by 
the interaction of two primary components which, whan Juxtaposed at vari- 
ous points of coincidence, can be made to yield secondary alphabets. 

interrupted-key columnar transposition . A columnar transposition system in 
Which the plaintext elements are inscribed in a matrix in rows of irregu- 
lar length as detenoLned by a numerical key. 

interrupter system. A polyalphahetlc substitution system in which the key 
is interrupted upon the occurrence of a prearranged letter or letters of 
the plain text or of the cipher text. 
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Intenral. n. A distance between two points or occurrences, especially 
between recurrent conditions or states. The nuniber of units between 
a letter, digraph, code group, etc., and. the recurrence of the saae 
letter, digraph, code group, etc., counting either the first or second 
occurrence but not both. Frequently called crypfc*"*''YSt*e Interval . 

Intuitive method. A method of solution nahlng use of probable words, proba- 
ble keys, the supposed psychology of the encipherer, the reports of es- 
pionage services, and all other factors derivable firom a given situation. 

Inverse »trlx . In the eryptanalysls of a polyalphabetlc substitution sys- 
tem, a reconstruction matrix in which the cipher eleosents are located In 
the row above the matrix, and the plaintext equivalents are placed within 
the matrix. 

iBolog. n. A cryptogram in which the pGLaln text is Identical or nearly 
Identical with that of a message encrypted In another system, key, code, 
etc. 

Isologous . adj. Pertaining to or having the nature of an Isolog. 

If xnonfli. n. A sequence of plain, eli^r, or key elements which exhibits 
‘ an idlomorph Identical with that of another sequence. 

Isomorphic, adj. Of or pertaining to Ismoorphlsm or Isomorpha. 

Isamorrdilsm, n. The existence of two or more Identical Idlomorphs. 

Jefferson cipher. A polyalphabetlc substitution system Invented by Thomas 
Jefferson and Independently at a later date by the Frendi cryptographer 
Baaerles. It provided for encipherment by means of a operated 

device Involving a nusiber of revolvable disks, each bearing a mixed 
alphabet on its perlipbery. 

kappa ( K ) i.c . In comparing two superimposed sequences of text, the ratio 
of the observed nunher of coincidences to that expected for random. 

kappa plain ( k.q) constant. A mathematical constant employed In coincidence 
tests such as the pniTest, to denote the probability of coincidence of a 
given plaintext element or unit. It is the sum of the squares of the 
probabilities of occurrence ot the different textual elements or units 
as they are employed in writing the text; for example. In English tele- 
graphic plain text, the monograj^e and dlgraphlc plain constants are 
.0667 and . 006 S^ respectively. 
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kappa random ( Kp) conetant . A aathaaatieal eonatant employed la eolneldanee 
usta Bueh as tbe pibl lEeat to daaote the probability of edneidenee of a 
given textual element In random text. It Is merely the reciprocal of tbe 
total nuaftier of characters used In vrlting the text. If a 26-letter al- 
phabet were employed^ for instance, the constant denoting the probability 
of coincidence of various textual elements vould be derived as fialloirs: 

a. slncp.e letters 1/26 ■ .0385 

b. digraphs I/0T6 ■ .OOIW 

c. trlgraphs l/l7«576 ■ *000057 

kappa ( K ) test. A test applied to two superimposed sequences of text to 
tttemlne ahether or not they are correctly suparlmposed. See KAPPA 

(k) i.c. 



key, n. 1 . In cryptography, a symbol or sequence of syidiols applied to 
successive textual elements of a message to control their encryption or 
decryption. 2 . A specific key. 

key book. A book containing key text, or plain text forming specific keys. 

fcayed col'' taransposltlon. A transposition system In ahlch the eo 1 .uans 
of a matrix axe taken off in the order determined by the specific key, 
ahlch Is often a derived numerical k^. 

key letter. A letter of key; especially in pdyalphabetlc ciphers, the 
letter determining ahlch of the available cipher alfOiabets Is used to 
encipher a particular letter. 

key Phrase. An arbitrarily selected phrase used as a key or firom ahlch a 
key Is derived. 

key recovery. The cryptanalytlo reconstruetiaB of a key. 

key text. Tlext firam ahlch a key Is derived. 

key aerd. An arbitrarily aelected aord used as a key per se. or from ahlch 
a key Is derived. 

keyaord. adj. Of or pertaining to a key aord or key aords; as, the keyaord 
recovery. 

keyaord-adxed alphabet. An alphabet constructed by arltlng a prearranged 
key aord or key phrase (repeated lettmw. If present, being omitted 
after their first occurrence), and then completing the seqioenee from 
the unused letters of Ihe alphabet In their normal sequence. 

laabda (A) test. A test for monoalphabetlclty In a message, based on a com- 
parison of the observed number of blanks in Its frequency distribution 
alth the theoretically expected nunber of Uanks both In (a) a normal 
plaintext message of equal length and (b) a random assortment of an equal 
number of letters. Also called the blank-expectation test. 
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latent repetition. A plaintext repetition not apperent in eiptaer text ^t 
eusceptltle of being made patent as a result of analysis. 

lateral difference. See DELTA. 

Latin square. A cipher square in vhieh no rov or eolunn contains a re- 
peated synbol. 

lexical, adj. Otj pertaining to, or conneeted with words. In its erypto- 
loglc sense, the word is used to charaeterlae those cryptographic mathods 
(chiefly codes) which deal with ‘j^Lalntext eleaents comprising complete 
words, phrases, and sentences. 

link, n. The existence of direct coDsnunicatlon facilities between two points 

literal key . A key composed of a sequence of letters. Cf. NUMEEtICAL KEY. 

logarithmic score. The sum of a set of logarithmic wei^^ts of a given sarn- 
ie of text. 

logarithmie weights . Eunerleal wel^ts assigned to units of text, which 
welj^ts are actually logarithms of the probabilities of the textual units, 
and which are used to evaluate the results of certain eryptanalytlc opera- 
tions. 



low-echelon, adj. Pertaining to organizational units below the level of the 
army division or its equlval^t in the other Services. 

low-grade. adJ. Pertaining to a cryptosystem which offers only slledit re- 
sistance to cryptanalysis; for example: (l) Playfair ciphers, (2) single 

transposition, ( 3 ) unenciifliered one-part codes. Cf. MEDIUM-GRADE and 
HIGH-GRADE. 

mark impulse. One of the two types of impulses used in teleprinter trans- 
mission; narmally, that Impulse during whibh current flows through the 
telepsrinter receiving magnet. The other type of impulse is the space 
Impulse, q. v. 

matching. adJ. Shifting of two or more monoalphhbetie firequency distribu- 
tlona so as to bring them into proper alignment for amalgamation into a 
single monoalphabetlc distribution. 

matrix, n. A geonetrle form or pattern. In transposition systems, the 
figure or diagram in which the various steps of the transposition ars 
effected; in substitution systems, the figure or diagram containing the 
aequence or sequences of plain text or cipher symbols. 

medium-grade, adj . Pertaining to a cryptosystem which offers considerable re 
slstance to cryptanalysis; for example; (l) strip ciphers, (2) double tra 
position, ( 3 ) unenclpAiered two part-codes. Cf. LCM-GRADB and HIGH-(3tADE. 

mBseage. n. Any thought or idea expressed in plain or secret language, pre- 
pared in a form suitable for transmission by any means of coamunicatlon. 

message indicator . A group of letters or nuabers placed within an encrypted 
message to designate the keying eleaents applicable to that message. 
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aessage keying element. Tbat part of the key vhleh changes with every 
neeaage. 



minuend Method. The method of enelidaerment vhereln the eryptograidile 
equations are K - P ■ C, and K - C ■ F. Cf. AIS)IT1VE MBIQOD and 
SUSnUCTIVE METQQD. 

minuend system . A system In vhleh encipherment Is accomplished by sub- 
tracting the plain text ftrom the key; In the process of decipherment, 
the enciphered text Is subtracted ftrom the key* Cf* SUBTRACTIVE SXSTBH. 

mixed cipher alphabet * A cipher alphabet In vhleh the sequence of letters 
or characters in one or both of the eomponents Is not the normal sequence. 

mixed-length system . A cryptosystem In vhleh the units of cipher text or 
code text are of Irreguliu: or nonconstant length, as for example, a 
monoiBB-dlnome system, or a code system employing both 4-letter and 5- 
letter groups. 

mnemonic key . A key so constructed as to be easily remeiriiered. 

modular, adj. Pertaining to a modulus, q. t. 

modulo, adv. With respect to a modulus, q. ▼. (Abbr. modj e.g., mod 10, 
mod 26 , etc.) 

modulus, n. Seale or basis of arithmetic; the nuniber n Is called the modulus 
vhen all nunibers vhleh differ from each other by n ot a aultlple of n are 
considered equivalent. ~~ 

monoalphabet. n. Monoalphabetleally enciphered text. Also a frequency dis- 
tribution exhibiting monoalphabetlelty . q. v. 

monoalphabetle . adj. Of or pertaining to monoalphabetlelty . q. v. 

monoalphabetlelty . n. A characteristic of encrypted text vhleh indicates 
that it has been produced by means of a single cipher alphabet or an 
unenclphered code system using a slnglm code book. It is normally dis- 
closed by frequency distributions irixich display 'Voufi^ness,'' or pro- 
nounced variation In relative frequencies. 

monoalphabetle substitution. A type of substitution employing a single 
cipher alphabet by mBaasT of lAleh each ciidxer equlralent, composed of 
one or more elements. Invariably represents one particular plaintext 
unit, vherever it occurs throughout axqr given mesmige* 

monograph, n. A single letter. 

monoernphle . adj. Of or pertaining to any units comprising single characters. 
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normal ftregueney. Ihe standard freqfjmusy of a textual unit or letter 
relative to other textual units or letters, as disclosed hy the sta- 
tistical study of a laree voluine of homogeneous text. Also called 
characterletlc fteouency. 

normw-i aeouenee. !Ehe normal alphabetical sequence of those letters which 
are used In the written text of any particular language, or any cyclic 
pemitatlon thereof. 

narmal up^^^^^teral ftrequency distribution. A distribution showing the 
standard relative frequency of sin£^ plaintext syahols as disclosed 
by statistical study of a large volume of text. 

null, n. In cryptography, a aynibOl or unit of encrypted text haring no 
l^Ialntext slg^flcanee. 

numerical key. A key composed of a sequence of nunhers. Cf. LTEERAL KEf. 

ipniianH.«^n y-v*yA d columnar transnosltion. A columnar transposition system 
In which the columns of a matrix are taken off In the order determined 
by a numerical key. 

off the cut. As applied to the division of cipher text Into polygraphs, 
beginning elsewhere than with the Initial character of a bona fide 
polygrai^. 

one-part code. A code In which the plaintext elements are arranged In 
alphabetical, numerical, or other systematic order accompanied by their 
code groups also arranged In alphabetical, numerical, or other systema- 
tic order. 

one-time pad . A form of key book used in a one-time system, so designed 
as to permit the destruction of each page of key as soon as It has been 
used. 

one-time system. A cryptosystem In which the key, normally of a random 
nature. Is used only once. 

on the cut . As applied to the division of text into polygraihs, beginning 
with the first texual character. 

padding, n. Extraneous text added to a message for the purpose of con- 
cealing Its length and beginning or ending or both. 

paraphrase, v. t. To change the phraseology of a message without changing 
Its meaning. 



pM*hian Y.idlgraphlc system. A dlgraj^c sidwtltutlon system In which the 
encipherment of certain members of the polygraphs show group relation- 
ships; small matrix systems, such as the four-square, two-square and 
Playfair systems Involve such group relationships and are therefore 
partlally-dlgraphic systems. 
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partition, n. Resolution of an Integer Into a set of Integers (e.g., repre- 
sentation of tbe Integer 6 as 1 and 5 , 2 and 4, or 3 and 3.— ▼. t. In 
key analysis, to reserve tiie actual into the separate key contribu- 
tions made by the eompoeent factors. 

patent repetition. A repetition vhlch Is externally visible In exicrypted 
text. Cf . LA3SETT REPETITION. 

pentagraph. n. A set of five letters. 

pentanone. n. A set of five digits. 

periodic, adj. Characterised by cyclic attributes or usage, as of key In 
a periodic system . q. v. 

periodic dlgaphlc syaten. A system Involving a BultlpUclty of dlgraphlc 
systems, wed cyclically. 

periodic polyalphabetlc substitution . A method of encipherment Involving 
the eyelle use of two or more alphabets. Also called repeating -key 
method. 

periodic system . A system In which the enciphering process is repetitive 
In character and which usually results In the production of cyclic 
phenomena In the cryptographic text. 

penaitatlon table . A table designed for the systematic construction of 
code groups. It may also be used to correct garbles In groups of code 
text. 

idil (d) test. A test applied to a frequency distribution to determine 
whether It is monoalphabetlc or not. See also KAPPA PLAIN CONSTANT 
and KAPPA RANDOM CONSTANT. 

physical security. That component of security which results from all physi- 
cal measures necessary to safeguard classified equipment and material 
from access by unauthorised parsons. 

plain, adj. Of or pertaining to that which is unencrypted. See also 
pLainoexi. 

plain code. Unenelphered code. 

plain component . She seqpence of plaintext syidbols In a cipher alphabet. 

plain component egulvalenta. In connection with the mathod of completing 
the plain component sequence, the plaintext equivalents for cipher units 
derived from an arbitrary juxtaposition of tbe coiqponents of a cipher 
alphabet. 

Plain language . Plain text, q. v. 
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plain text. 1. Ncanal text or language vhieh, with no hidden or aeeret 
neaalng, eonveys knovledge. 2. Iha Intelligible text xuderlylng a 
cryptogram. 

plaintext . adj. Of or pertaining to that iriileh cowreys an Intelligible 
meaning In the language In vhleh It la written with xio hidden meaning; 
as the plaintext equivalents. Often shortened to plain . 

plaintext autokey system. An aperiodic substitution system In which the 
key, foUotflng the application of a previously arranged initial key. Is 
generated ftrom elements of the plain text of the message* 

plaintext Interruptor. In certain aperiodic substitution systems, a specific 
plaintext letter which, by preazrangement, serves to Interrupt the keying 
cycle and thus suppress periodicity. 

Playfair system. A type of dlgraphlc substitution using a single matrix 
xiormally of 2? cells. 

Poisson table . Table of the Poisson distribution. A special ‘^pe of mathe- 
matical table contemning probability data applicable to the phenomena of 
repetitions expected to obtain In samples of random text; used In crypta- 
nalysis to determine whether or not the repetitions observed in a given 
sample of cryptographic text are causal or random repetitions. 

polyalphabetlclty . n. A characteristic of encrypted text which indicates 
that It has been produced by more than one cipher alphabet. It Is nor- 
mally disclosed by Areqiaeney distributions which display "smoothness", 
or lack of pronounced variation In relative frequencies. 

polyalnhabetle substitution. A type of substitution in which the successive 
nlalntcKrt filaments n*f_a masSAAB- ii ftiiAllv fllnarlA etiftlTAargA 
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primary component . The haale eompooent ftrom lAleh other eomponetitB may be 
derived or irtilch may be alld against another basic component to produce 
aecondary alphabets. 

probable vord . A vord assumed or kncwn to be present In the underlying 
plain text of a cryptogram. A crib. 

probable -vord aathod . The method of solution Involving the trial of plain 
text assumed to be present In a cryptogram. 

proforma message. A message In standardized form, designed to convey in- 
teUlgence by conventions of azrangement and abbreviation. 

progressive alTaiahet system . A periodic pdyalpbabetlc substitution sys- 
tem In which the successively used cipher alphabets are produced by 
successively sliding a pair of sequences through all possible Juxtaposi- 
tions. 

proportion, v. t. In cryptology, to derive additional values In an Indirect 
synmetry reconstruction matrix by comparing patent four-element propor- 
tions with other proportions in which only one of the elements Is missing. 

pseudo-dlgraphlc system. A digraphlc substitution system In which one of 
the letters In each digraph Is enciphered monoalphabet Ically . 

random, adj. 1. In mathematics, pertaining to unsystcanatlc or chance varia- 
tions firam an expected norm. 2. In cryptanBlysls , pertaining to any 
situation In which a statistical analysis will shw variations from, a 
calculated expected norm which variations are Indistinguishable from 
those due to chance. 

random text . Text which appears to have been produced by chance or acci- 
dent, having no discernible patterns or limitations. 

rapid analytical machinery. Any hle^-speed cryptanalytlc machinery, usually 
electronic or ihotoelectrlc in nature. Abbr. RAM. 

raw traffic . Intercepted traffic shoving no evidence of processing for 
eonmunleatlon Intelligence purposes beyond sorting by clear address ele- 
ments, elimination of unvanted messages, and the Inclusion of an arbi- 
trary traffic designator. 

read, v. t. 1. To decrypt, especially as the result of successful crypta- 
nalytlc Investigation.— v. 1. To yield Intelligible plain text iriien 
decrypted. 

readable. adJ . Perted.nlng to those code and cipher systema in which suf- 
ficient plaintext valxies or keys have been recovered to permit the 
reading of messages encrypted in these systems. 

reciprocal cipher alphabet . A cipher alphabet in which either of the two 
sequences may serve as plain or cipher since the egiolvalents eschlblt 
reciprocity. 
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reeiproelty. n. As used in cryptology, interchangeability of plain-cipher 
relatiraS^ps (e.g., Ap ■ Be and £p ■ Ac). 

reconstruction matrix. A skeleton natrix eaiployed in the solution of crypto- 
systems involving a substitution matrix. It aids in the correct relative 
placement of plaintext or ciphertext ^ralues as recovered, and thus often 
affords clues as to the internal arrangement of the original matrix. 

related alnhabets . Any of the several secondary cipher ali^bets iriiich are 
produced by sliding any given pair of primary components against each other. 

relative code. Code text tvcm. ehich an encipherment has been removed in 
relative terms, but not reduced to plsin-code text, so that the groups 
differ from the actual original plain code by an Interval constant for 
every group, thus the difference between two relative code groups is the 
same as that between their plain-code equivalents. 

relative flrecueney. In its cryptologic application, the ratio of the actual 
occurrences of a textual element to the nimber of possible occurrences 
within a given text. 

repeating key. A key used cyclically, which therefore repeats. 

repeating-key system. Periodic pdyalphabetic substitution, 4. v. 

repetitive eneiphement . A type of encipherment in which the primary cipher 
text of a cryptogram is subjected to further eneii^ierment with either the 
same or a different system. Double transposition is a frequently encoun- 
tered example of repetitive enelphermant. 

reveraed standard cipher alphabet. A cipher alj^iabet in which both the 
plain and cipher coiqponents are the normal sequence, the cipher compo- 
nent being reversed in direction from the plain component. 

revolving grille. A type of grille in which the apertures are so distributed 
that when the grille is turned successively throve^ four angles of 90 
degrees and set in position on the grid, all the cells on the grid are 
disclosed only once. Also called rotating grille. 

rotating grille. See REVOLVING ( 20 LUB. 

rotor, n. A disk designed to rotate within a cipher maefalne and which con- 
trols the action of some other machine component or produces a variation 
in some textual or keying element. 

rotifThnees . n. A pronounced variation in relative ftrequeneies of the ele- 
Bients considered in a frequency distribution. Of. SMOOTHNESS. 

route transposition . A method of transposition in which the ciphertext equiv- 
alent of a message is obtained by transcribing, according to any prear- 
ranged route, the letters inscribed in the cells of a matrix into which 
the message was inscribed earlier according to some prearranged route. 
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running -key Byetem. A polyalidiabetic substitution system which employs a 
nonperiodic key srbltrarlly porepsred or obtained firam a book or any 
continuous text* 

score, n* She sum of the veldts of a given set of characters.— t. To 
derive the sum of such veie^ts In cryptomathematles* 

scoring method. A method of assigning veiedxts to elements of plain text, 
cipher text, or key* as a means of establishing thresholds or criteria 
In eryptomatheiimtlcs* 

secondary alnhabet. An enciphering or deciphering alphabet resulting from 
the Juxtaposition of two primary ecn^nents, at least one of which Is 
mixed. A secondary alphabet, thou^ different In appearance firom the 
primary alphabet. Is eryptographicBlly equivalent to the primaxy alpha- 
bet. 

sectional matrix . In polyalphabetlc substitution systems, an enciphering 
matrix consisting of two or laove sections, such as In the ease of sepa- 
rate vowel and consonant encipherment. 

separator, n. See WQBD SSPABATOR. 

sequence, n. An ordered arrangement of symbols (letters, digits, etc.) 
having continuity. Specifically, the members of a component of a cipher 
alphabet In order; the symbols In a row, column, or diagonal of a cipher 
square in order, key letters or key figures In order. 

setting, n. !Ihe aanmngement and alignment of the variable elements of a 
cryptographic device or Bmchine at any moment during its operation. 

sigma (^. n. A synibol for the standard deviation. 

slgm^. n. As used In eryptamathematles, a measure of the deviation Aram 
tne normal, expressed In terms of nuzabers of sigmas (e). 

a-tmnia substitution. Monoalph ab etlc unlllteral substitution. 

simple tlon. See SINGLE 3SANSPOSITION. 

tyanapoattlon. A transposition In which only one inscription and 
one transcription are effected. 

sliding alphabet . A pair of components idiidi may be slid to any point of 
Jui^posltlon. 

strip. A strip of cardboard or slmLlar material which bears a 
seq^nce ^ which can be slid against other such strips to various 
Juxtapositions . 

smoothness, n. Ihe lack of pronounced variation In relative frequencies 
of thaelements considered in a Araquency distribution. Cf. ROUGHNESS. 
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solution, n. In its cryptaneOytic application, the process or result of 
solving a cryptogram or cryptosystem by cryptanalysis. 

solve . V. t. To cryptanalyze . To find the plain text of encrypted com- 
munications by cryptanalytlc processes, or to recover by analysis the 
keys and the principles of their application. 

space impulse. One of the tvo types of ijqpulses used in teleprinter trans- 
mission; normally, that impulse during which no current flows throu^ 
the teleprinter receiving magnet. The other type of impulse is the mark 
impulse, q. v. 

special solution . A solution which depends on circumstances which are not 
caused by the Inherent principles of the particular cryptosystem. For 
example, solution of a periodic system by exploiting a pair of Isologs 
which have been produced by identical sliding components but idiich use 
two different repeating keys; solution of a double tretnspositlon system 
by simultaneously anagrammlng the corresponding elements of several 
cryptograms which are of identical length and which all use the same 
specific key; etc. 

specific key. An element which is used with a specific cryptosystem to 
determine the encipherment of a message and which Incliides both the 
message keying element and the dally k^lng element . It may consist of 
a letter, nuoiber, word, phrase, sentence, a special document, book, or 
table, etc., usually of a variable nature and easily changeable at the 
will of the correspondents, or prearranged for them or for their agents 
by higher authority. 

square, n. See MA3BIX. 

square table. A cipher sqjuaxe (e.g., a Vigenere table). 

st€wger. n. The situation chaaracterlsing a pair of Isologs enciphered by 
Identical keys, where the two pdaln texts are identical except for the 
addition or deletion of a letter or letters. 

standard cipher alphabet . A cipher alphabet in which the sequence of letters 
in the plain component la the normal, and in the cipher component is the 
same as the normal, but either reversed in direction or shifted firom its 
point of coincidence with the plain component. 

standard unlliteral frequency distribution . See BOBHAL UNILITERAL FREQUENCY 
DISTRIBUTION. 

Stencil, n. See CSlLIf. 

Stereotype . n. A word, number, phrase, abbreviation, etc., which as a re- 
sult of language habits, has a hlg^ probability of occurrence, especially 
at the beginning or ending of a message. 
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stereotyped messageg . Related encrypted messages vhleh are recognisable as 
such because of distinctive eharacteristlcs of the underlying plain text. 

strlp-clirfier device . A cipher device employing sliding alphabet strips. 

strip-cipher system . A polyalphabetlc substitution system employing sliding 
strips In conjunction vlth the variable -generatrix principle as In the 
Jefferson clidier. 

stutter group . A group consisting of a repeated single character, as 55555 
or REEBE, xisually a four or five character group. 

substitution alphabet . See CIPHER ALPHABET. 

siibetltutlon cipher . 1. A cipher system In which the elements of the plain 
text are replaced by other elements. 2. A cryptogram produced by en- 
ciphering a plaintext message with a substitution system. 

substitution system . A system in which the elements of the plain or code 
text are replaced by other elements. 

subtractive method . The method of encli^rment wherein the cryptographic 
equations are P - K ■ C, and C ^ K ■ P. Cf. ADDITIVE MBTWD and MIBUEND 
METHOD. 

subtractive system . A system In which encipherment Is accomplished by sub- 
tracting the key from the plain text; In the process of decipherment, 
the encl^ered text Is added to the key. Cf. MINUEND SXBTQl. 

sum check . A digit of a textual group which Is the sum (mod lO) of the 
other digits In the group.— v. 1. To exhibit the property of a sum 
check. 

sum-checking digit . A preselected digit (normally the final digit) In a 
code or cipher group which is the noncarrying sum of the other digits In 
the group. 

Buperenclpherment . n. A form of superexicryptlon In which the final step 
Involves encipherment. 

superencryptlon . n. A further encryption of the text of a cryptogram for 
Increased security. Enciphered code Is a ftequently encountcsred exam- 
ple of superencryptlon. 

syllabary, n. In a code book, a list of Individual letters, combination 
of letters, or syllables, accompanied by their equivalent code groups, 
usually provided for spelled-out words or proper names not present In 
the vocabulary of a code; a spelling table. 

syllabary souare . A cipher matrix containing Individual letters, digits, 
syllables, ftreguent digraphs, trlgraiflis, etc., which are encrypted by 
the row and cdLumn coordinates of the matrix. 
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syllabic . adj. Of> pertaining tOj or denoting syllables o 

ayatea. n. Bee CSaFEOSlfSTBl. 

ayatea indicator . See DI8CRIMINA11T. 

tail. T. !• Of two nessagea, to exblbit tailing, q. ▼. 

tadUag;, n. 1. The practice of beginning the enelphement of one aaaaage 
vlth the elenent of key ianediately foUowlng the elenent of key used 
to encipher the last textual groups of the preceding aessage. 2, The 
practice of beginning the encipheroent of one nessage vith oachine coa- 
ponents aligned as they were after processing of the last textual group 
of the preceding aeaaage. 

telecoamnications « n. Any transaisslon, ealaslon, or reception of signs, 
signals, vrltlng, laages and sounds, or intelligenee of any xiature by 
wire, radio, ylsual, electronic, or other means. 

teleprinter, n. An electrically-operated Instruaent used in the trans- 
alsslon and reception-printing of aessages by proper sensing and inter- 
pretation of electrical signals. Also called teletypewriter . radio- 
printer. A specific rarlety of teleprinter is the Teletype, a trade- 
narked nachine aanufactured by the Tele^rpn Corporation. 

tetragraph. n. A set of fbur letters. 

tetamuagne. n. A set of four digits. 

text, n. The part of a nessage containing the basic Infomation whlhh the 
originator desires to be coansuileated. 

traffic, n. All trananltted and recelyed coanunications. Abbr. tfc. 

traffic analysis. The branch of cryptology which deals with the study of 
the external charactei'lstlcs of signal coBBsmicatlons and related aaterl- 
als for the purpose of obtaining InfomDstlon concerning the organisation 
and operation of a cosaunlcation system. Abbr. T/A. 

traffic intercept. A copy of a conaninl cation obtained throu^ interception. 

transcription, n. 1. In a transposition system, the process of remowlng 
the text from a matrix or grid by a method or route different firom that 
used in the inscription. 2. A written copy of a preyiously recorded 
radio transmissloa; also the process of preparing such copy from tapes 
or records. 

transmission security. That component of commiml cation security which re- 
sults frcm all measures designed to protect transmissions from inter- 
ception, traffic analysis, and Imitatiye deception. 
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two-wopt code. A raxidoolxed eode> eonalstlng of aa encoding section in 
which the plaintext groups are arranged in aa alphabetical or other 
ayatenatie order aceoapanled by their code groups arranged in a non- 
alphabetical or random order; and a decoding section, in which the code 
groups are arranged in alphatetleal or numerical ord» and are accompa- 
nied by their meanings as given in the encoding section* 

unlliteral, adj. Of, or pertaining only to cryptosystems, cipher alphabets 
and jEtequency distributions which involve cipher units of single letters 
or characters. See the more ineluaive term MQlKXauUPHZC; see also UBl- 
LIOERAL FREQUBICOeSIBIBUTION. 

uniliteral frequency distribution. A simple tabulation showing the frequency 
of individual characters of a text. 

uniliteral substitution . A cryptographic process in wUeh the individual 
letters of a message text are replaced by single-letter cipher equiva- 
lents. 



uniselector switch. A multipole-multilevel switch such as that used in 
automatic dialing telephone systems • 

0“ of ^ or more cipher or code syidbols which have the 
equivalent; also called variant value . 2 , One of several 
plaintext meanings which nay be reprcwentad by a single code group. 

Igalant systm. A substitution system in whibh some or all plaintext let- 
tern may be represented by more than one cipher equivalent. 

variant value . See VARIANT. 

3 ^nam system. A cipher teleprinter system employing a prepared tape of 
random teleprinter characters used to key another tape contalnlnTthe 
plain text to be encrypted. 

84 oare commonly attributed in cryptographic 
litCTature to the French cryptographer Blaise de Vlgenere (1523-1596) 
tte normal sequence at the top (or bottom) and at the left (or* 
right), with cycUc permutations of the normal sequence forming the 
successive rows (or columns) within the square. 

Vigenere systga. A cryptosystem enqaoying a Vlgeniere amiwa, y. 



weig^ n. A value assigned to units of text or key, used to evaluate the 
results of certain cryptanalytlc operations. evaluate the 
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Wheatstone cipher device. A cipher derlee consisting essentially of two 
rings mounted concentrically In a single plane, the outer (and larger) 
ring being the plain component of the device and comprising 27 equlslsed 
divisions, the Inner (and smaller) ring being the cipher component, com- 
prising 26 smaller dlvlslcnis. The device incorporates two bands Simi- 
lar to those on a clock) pivoted at the center of the device— the larger 
hand serving the outer ring and the smaller hand the Inner— so geared 
together that for each complete revolution of the larger, the smaller 
turns throuj^ one can^lete revolution plus one tventy-sixth. 

vord pattern . The characteristic arrangement of repeated letters in a vord 
which tends to make It readily Identifiable when enclfAiered monoalpha- 
betlcally. See IDIONOiRFHISM. 

word separator . A unit of <me or more characters employed In certain 

cryptosystemR to Indicate the space between words. It may be enciphered 
or unenelphered. Also called a word spacer. 

word transnosltlon. A cryptosystem In which whole words axe transposed ac- 
cording to a certain preaxranged route or pattern. 

»1 (t) I.C. See CROSS I.C. 

ZKHDIAH Problem . A large-scale problem In cxyptanalysls and traffic analy- 
sis performed on a volume of traffic Intercepted during an amphibious 
operation against the hypothetical country of Zendla. 
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SUMMARY OF BASIC FCEBULAS 
AHD USEFUL TABUB 



A. Fonulu 



4 © 

2 . ^ 



vtiare ■ firequeney of each elemont in distri- 
bution* 

^ vhere H ■ total mndber of tallies In distribution and 
° e ■ Budber of categories in alphabet* 



3. ^ ■ KpH(H-l), where Kp * repeat rate for the particular language; 

for English, the monographic Kp s .0667* 



5. 7© " ^^l^lf where fi and fi'are frequencies ©f corresponding 

elements In two distributions being matched. 

6. % r " where Hi and S2 are the total number of tallies In two 

^ distributions being matched* 



7. 

8 * 

9. 



Xm • 

ll.C* 



KpH^Ha 

Z© _ elfjfi" 
" Zr ■ H1H2 



O' 



V2(c-1) 

Vh(h-i) 



standard deviation of Jl*C* of samples drawn Aram 
a flat populatlra* 



10 . S ■ o^oogygfl- * 1*00 ■ slgmage of i 1 *C* of samples drawn from 

^ a flat population. 
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B. Handy slide rule aettlnga^ 

1. 4r ^ 26"letter taxt i 

To N on D Bet 26 on C; under (H^) on C read ^ on 0. 

2. 4 p Bnglleh plain test : 

To H on D set (H-l) on Clj under .0667 on C read 4p on D.^ 

3. 5 I.C. for 26-letter text ; 

To 26 on A aet (N - 0.3) on Cj over 4o B read ^ I.C. on A.^ 
k, Xr fog 26-letter texti 

Uae aettlnga In (l), abovoi rubatltuting H2 fOr (H^). 

3. Xa for BnaJ-ioB i^lain text: 

Uae aettlnga In (2), above, aubatituting fOr (H*l). 

6. tl.C. for 26«letter diatributlona: 

To 26 on D aet Hi on C; nove hairline to Xo on C; allda on C 
to hairline, under Index of C read % I.C. on D. 

7. g*. for flat poimlatlon (26-letter text): 

To 7.07 on D aet (H - 0.3) on C; under Index of C read o- on D. 

8. O', for flat population (digital text): 

To li>.2l» on D aet (H - 0.3) on C; under index of C read o' on D. 

^ Hie ciqueisions below, except for No, 6, are solvable with one setting of die slide. 

^ For languages other than Englldi, substitute the approjHlate Kp instead of the . 0667 given. 

^ hi this fonnida, (N - 0 . 5 '^ is used as a convenient approximation to N(N-1); the error it negligible 
for slide rule computation, since (N - 0.5)? = N(N-l) + 0.25. 



kLk 






(4 



No. of 
letters 


E( 2 ) 


Expected number of digraphs occumng exactly x times 

B( 3 ) H( 4 ) B( 3 ) B(6) B(7) B(8) 


B( 9 ) 


a(io) 


100 


6.21 


0.298 


0.011 














200 


21.8 


2.12 


0.134 


0.009 














42.3 

63.3 


6.23 

12.8 


0.683 

1.87 


0.060 

0.220 


0.004 

0.022 


0.002 








300 


88.1 


21.6 


3.97 


0.382 


0.071 


0.008 








600 


110 


32.3 


7.11 


1.23 


0.184 


0.023 


0.003 






700 


129 


44.3 


11.4 


2.35 


o. 4 o 3 


0.039 


0.008 


0.001 




800 


143 


57.1 


16.8 


3.96 


0.777 


0.130 


0.019 


0.003 




900 


158 


70.1 


23.2 


6.16 


1.36 


0.237 


0.043 


0.006 


0.001 


1000 


169 


83.0 


30.6 


9.03 


2.21 


O.I166 


0.083 


0.014 


0.002 



Mo. of Expected number of Digraphs 
letters E(3) E(4) 



100 

200 

300 

too 

300 

600 

700 

800 

900 

1000 




6.83 

9.81 

13.3 

17.3 
21.8 
26.8 



0.111 

0.175 

0.261 

0.371 






0.001 

0.002 

0.003 

0.003 

0.008 



No. of 
letters 



100 

200 

300 

too 

300 

600 

700 

800 

900 

1000 




.010 




.043 




.096 




.171 




.270 




.389 




.530 




.693 




.877 




..08 


0.001 



Mo. of 
letters 


Pentagraphs 

B(2) 


100 




200 


0.002 


300 


0.004 


4oo 


0.007 


300 


O.OU 


600 


0.013 


700 


0.021 


600 


0.027 


900 


0.034 


lono 


0.042 



. fixpeetad values of ^ and 




♦r 



11 k.23 

12 3-08 
13 6.00 
1^ 7-00 
13 8.08 

16 9.23 

17 10.3 

18 11.8 

19 13.2 

20 lif.6 

21 16.2 
17.8 
19.5 
21.2 
23.1 

23-0 

27.0 

29.1 



7.3^ 

8.80 

10.4 
12.1 

14.0 

16.0 

18.1 

20.4 

22.8 

23.3 
28.0 

30.8 

33.8 

36.8 
to.o 

43.4 

116.8 

30.4 



» tr 



29 31 54 

30 33 58 

31 36 62 

32 38 66 

33 4l 70 

34 43 75 

35 46 79 

36 48 84 

37 51 89 

38 34 94 

39 57 99 

to 60 104 

41 63 109 

42 66 113 

43 69 120 

44 73 126 

43 76 132 

46 80 138 



♦r ♦p 



47 83 144 

48 87 130 

49 90 137 

30 94 163 

31 98 170 

32 102 177 

33 106 184 

34 110 191 
33 U4 198 
36 118 203 
57 123 213 

38 127 221 

39 132 228 

60 1^ 236 

61 l4l 244 

62 143 232 

63 150 261 

64 133 269 



B tr +p 



160 277 
163 286 
170 293 

175 304 
IBO 313 

186 322 
19L 331 
197 34l 

202 351 
208 360 
213 370 
219 380 
223 390 
231 tol 
237 ^ 
243 422 
249 <^32 

235 443 



♦r 0p 



262 434 
268 463 
275 476 
281 488 
288 499 
294 311 
301 522 
308 334 
315 546 
322 558 
329 571 

336 583 

343 596 
351 608 
338 621 
366 634 
373 647 
381 660 






































(for 10 and 26 eategorlea) 



®10 ®26 



11 .41 .67 

12 .37 .62 

13 .34 .57 

14 .31 .52 

15 .29 .49 

16 .27 .46 

17 .26 .43 

18 .24 .40 

19 .23 .38 

20 .22 .36 

21 .21 .35 

22 .20 .33 

23 .19 .31 

24 .18 .30 

25 .17 .29 

26 .17 .28 

27 .16 .27 

28 .15 ,26 



29 .15 .25 

30 .14 .24 

31 .14 .23 

32 .13 .22 

33 .13 .22 

34 .13 .21 

35 .12 .20 

36 .12 .20 

37 .35 .19 

38 .11 .19 

39 .11 .18 

40 .U .18 

41 .10 .17 

42 .10 .17 

43 .10 .17 

44 .10 .16 

45 .10 .16 

46 .09 .16 



^0 ®26 



47 .09 .15 

48 .09 .15 

49 .09 .15 

50 .09 .14 

51 .08 .14 

52 .08 .14 

53 .08 .13 
94 .08 .13 

55 .08 .13 

56 .08 .13 

57 .08 .13 

58 .07 .12 

59 .07 .12 

60 .07 .12 

61 .07 .12 

62 .07 .11 

63 .07 .11 

64 .07 .11 



H 


®10 


® 26 


65 


.07 


.11 


66 


.06 


.11 


67 


.06 


.11 


68 


.06 


.10 


69 


.06 


.10 


70 


.06 


.10 


71 


.06 


.10 


72 


.06 


.10 


73 


.06 


.10 


74 


.06 


.10 


75 


.06 


.09 


76 


.06 


.09 


77 


.06 


.09 


78 


.05 


.09 


79 


.05 


.09 


80 


.05 


.09 


81 


.05 


.09 


82 


.05 


.09 



.09 .09 
.05 .08 
.05 .08 
.05 .08 
.05 .08 
.05 .08 
.05 .08 
.05 .08 
.05 .08 
.05 .08 
.05 .08 
.05 .08 
.04 .07 
.04 .07 
.04 .07 
.04 .07 
.04 .07 
.04 .07 




tatlon of flgnajca of jl.C 



Valuaa of x 




Chi -square 
distribution 




6.6 


6.4 


12 


13 


24 


28 


49 


64 


100 


160 


220 


430 


480 


1,200 



Horaal 

distribution 




44 

161 

740 

4,310 

31,500 



The sigmage In the first column will be equaled or exceeded by pure chance, on the average, once 
every times as shown in the table. Since the distribution of die S I. C. is closely approximated by the 
distribution (up to about diis latter is a good measure for evaluating die sigmage of the ^I.C. 
For example, a distribution of 60 random letters has (from table E, above) a standard deviation of . 12; now 

1 w 1 flfl 

if a 60- letter sample under study has an observed {LC. of 1. 36, die sigmage S = — — — ^ — = 3, which 

is dien found m die table above as represenung one chance in 160 of equaling or exceediag this deviation if 
die sample were drawn from a random population. The Nonaal distribution appended here for comparison 
purposes has often been used, incorrectly so, for evaluating die sigmage of the ^ LC. ; after a sigmage of 
1 1 / 2 , the Normal distribution is a very poor approximation of the distribution of die Si. C. 
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&■ Jaetor table 
(nuaibera l-too) 



1 




51 


3 17 


2 




52 


2 4 13 26 


3 




53 






2 


54 


2 3 6 9 18 27 


5 




55 


5 11 


6 


2 3 


56 


2 4 7 8 14 28 


7 




57 


3 19 


6 


2 4 


58 


2 29 


9 


3 


59 




10 


2 5 


60 


234561012 15 20 30 


11 




61 


12 


2 3 4 6 


62 


2 31 


13 




63 


3 7 9 21 


U 


2 7 


64 


2 4 8 16 32 


15 


3 5 


65 


5 13 


16 


2 4 8 


66 


2 3 6 11 33 


17 




67 




18 


2369 


68 


2 4 17 34 


19 


2 4 5 10 


69 


3 23 


20 


70 


2 5 7 10 14 35 


21 


3 7 


71 




22 


2 U 


72 


23468912 18 24 38 


23 




73 




2 h 


2 3 4 6 8 32 


74 


2 37 


25 


5 


75 


3 5 15 25 


26 


2 13 


76 


2 4 19 38 


27 


3 9 


77 


7 U 


26 


2 4 7 14 


78 


2 3 6 13 26 39 


29 




79 




30 


2 3 5 6 10 1^ 


80 


245810162040 


31 


2 4 8 16 


81 


3 9 27 


32 


82 


2 4l 


33 


3 U 


83 




3^ 


2 17 


84 


2346712 14 212842 


35 


5 7 


85 


5 17 


36 


2 3 4 6 9 12 18 


86 


2 43 


37 




87 


3 29 


38 


2 19 


88 


2 4 8 11 22 44 


39 


3 13 


89 




ho 


2 4 5 8 10 20 


90 


2 3 5 6 9 10 15 18 30 45 


hi 




91 


7 13 


h 2 


2 3 6 7 14 21 


92 


2 4 23 ^ 


^^3 




93 


3 31 


hk 


2 4 11 22 


94 


2 47 


45 


3 5 9 15 


95 


5 19 


h 6 


2 23 


96 


2 3 4 6 8 12 16 24 32 48 


47 




97 




48 


2 3 4 6 8 12 16 24 


98 


2 7 14 49 


49 


7 


99 


3 9 11 33 


50 


2 3 10 25 


100 


2 4 5 10 20 25 50 
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101 




151 




102 


2 3 6 17 34 51 


152 


2 4 8 19 38 76 


103 




153 


3 9 17 51 


104 


2 4 6 13 26 52 


154 


2 7 n l 4 22 77 


105 


3 5 7 15 21 35 


155 


5 31 


106 


2 53 


156 


2 3 4 6 12 13 26 39 52 78 


107 




157 




108 


234691218273654 


158 


2 79 


109 




159 


3 53 


no 


2 5 10 n 22 55 


160 


2456101620324080 


in 


3 37 


161 


7 23 


112 


2 4 7 8 14 16 28 36 


l£2 


236918275481 


113 




163 




n 4 


2 3 6 19 38 57 


164 


2 4 4 l 82 


ns 


5 23 


165 


3 5 n 15 33 55 


116 


2 4 29 58 


166 


2 83 


n? 


3 9 13 39 


167 




118 


2 59 


268 


234678121421 24 28 42 


n 9 


7 17 




56 84 


120 


2 3 4 5 6 8 10 12 15 20 24 30 


169 


13 




4 o 60 


170 


2 5 10 17 34 85 


121 


n 


171 


3 9 19 57 


122 


2 61 


172 


2 4 43 86 


123 


3 4 l 


173 




124 


2 4 31 62 


174 


2 3 6 29 58 87 


125 


5 25 


175 


5 7 25 35 


126 


23679 i4i82142 63 


176 


248 ni 6 22 44 88 


127 




177 


3 59 


128 


2 4 8 16 32 64 


178 


2 69 


129 


3 43 


179 


2 3 4 5 6 9 10 12 15 16 20 30 


130 


2 5 10 13 26 65 


180 


131 






36 45 60 90 


132 


2346ni2 22 33 44 66 


161 




133 


7 19 


182 


2 7 13 14 26 91 


134 


2 67 


183 


3 61 


135 


3 5 9 15 27 45 


184 


2 4 8 23 46 92 


136 


2 4 8 17 34 68 


185 


5 37 


137 




186 


2 3 6 31 62 93 


138 


2 3 6 23 46 69 


187 


n 17 


139 




168 


2 4 47 94 


140 


245710 14 2028 35 70 


189 


3 7 9 21 27 63 


l 4 l 


3 47 


190 


2 5 10 19 38 95 


ite 


2 71 


191 




143 


n 13 


192 


2 3 4 6 8 12 16 24 32 48 64 96 


144 


234669121618 24 36 


193 






48 72 


194 


2 97 


145 


5 29 


195 


3 5 13 15 39 65 


146 


2 73 


196 


2 4 7 1^ 28 49 98 


147 


3 7 21 49 


197 




l 48 


2 4 37 74 


198 


2369 ni 8 22 33 66 99 


149 




199 


2 4 5 8 10 20 25 4 o 50 100 


150 


2 3 5 6 10 15 25 30 50 75 


200 



4^18 
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201 


3 67 


252 


2 3 4 6 7 9 12 l 4 18 21 28 


202 


2 101 




36 42 63 84 126 


203 


7 29 


253 


11 23 


204 


23461217345168102 


254 


2 127 


205 


5 4 l 


255 


3 5 15 17 51 85 


206 


2 103 


256 


2 4 8 16 32 64 128 


207 


3 9 23 69 


257 




208 


24813162652 104 


258 


2 3 6 43 86 129 


209 


u 19 


259 


7 37 


210 


2 3 5 6 7 10 l 4 15 21 30 35 42 


260 


2 4 5 10 13 20 26 52 65 130 




70 105 


261 


3 9 29 87 


21 L 




262 


2 131 


212 


2 4 53 106 


263 




213 


3 71 


264 


2 3 4 6 81112 22 24 33 44 66 


2 l 4 


2 107 




88 132 


215 


5 43 


265 


5 53 


216 


2346891218 24 2736 54 


266 


2 7 14 19 38 133 




72 108 


267 


3 89 


217 


7 31 


268 


2 4 67 134 


218 


2 109 


269 




219 


3 73 


270 


2 3 5 6 9 10 15 18 27 30 45 


220 


2451 O 1 L 20 22 44 55 110 




54 90 135 


221 


13 17 


271 




222 


2 3 6 37 7 ^ lu 


272 


2 4 8 16 17 34 68 136 


223 




273 


3 7 13 21 39 91 


224 


24781416283256112 


274 


2 137 


225 


3 5 9 15 25 45 75 


275 


5 11 25 55 


226 


2 113 


276 


2346122346 69 92 136 


227 

228 


2 3 4 6 12 19 38 57 76 114 


277 

278 


2 139 


229 


2 5 10 23 46 115 


279 


3 9 31 93 


230 


280 


2 4 5 7 8 10 14 20 28 35 4 o 56 


231 


3 7 n 21 33 77 




70 l 4 o 


232 


2 4 8 29 58 I16 


281 




233 




282 


2 3 47 94 l 4 l 


234 


2 3 6 9 13 18 26 39 78 117 


283 




235 


5 47 


284 


2 4 71 142 


236 


2 4 59 118 


285 


3 5 15 19 57 95 


237 


3 79 


286 


2 11 13 22 26 143 


238 


2 7 aA- 17 34 119 


287 


7 4 l 


239 


288 


234669121618243236 


240 


2 3 4 5 6 8 10 12 15 16 20 24 




48 72 96 144 




30 4 o 48 60 80 120 


289 


17 


24 l 


1 


290 


2 5 10 29 58 145 


242 


2 11 22 121 


291 


3 97 


243 


3 9 27 81 


292 


2 4 73 146 


244 


2 4 61 122 


293 




245 


5 7 35 49 


294 


2 3 6 7 l 4 21 42 49 96 147 


246 


2 3 6 4 l 82 123 


295 


5 59 


247 


13 19 


296 


2 4 8 37 74 148 


248 


2 4 8 31 62 124 


297 


3 9 U 27 33 99 


249 


3 83 


298 


2 149 


250 


2 5 10 25 50 125 


299 


13 23 


251 




300 


2 3 4 5 6 10 12 15 20 25 30 50 



-ooBnoamar 
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301 


7 43 


352 


2 4 81116 22 32 44 88 176 


302 


2 


353 




303 


3 101 


354 


2 3 6 59 118 177 


3 o 4 


2 4 8 16 19 38 76 152 


355 


5 71 


305 


5 61 


356 


2 4 89 178 


306 


2 3 6 9 17 18 34 51 102 153 


357 


3 7 17 21 51 119 


307 




358 


2 179 


308 


2 4 7 11 l 4 22 28 44 77 154 


359 




309 


3 103 


360 


2 3 4 5 6 8 9 10 12 15 18 20 24 


310 


2 5 10 31 62 155 




30 36 40 45 60 72 90 120 180 


311 


2 3 4 6 8 12 13 24 26 39 52 78 104 


361 


19 


312 


362 


2 181 


313 




363 


3 11 33 121 


31 ^ 


2 157 


364 


2 4 7 13 14 26 28 52 91 182 


315 


3 5 7 9 15 21 35 45 63 105 


365 


5 73 


316 


2 4 79 158 


366 


2 3 6 61 122 183 


317 




367 


24816234692184 


318 


2 3 6 53 106 159 


368 


319 


U 29 


369 


3 9 4 l 123 


320 


2 4 5 8 10 16 20 32 4 o 64 80 160 


370 


2 5 10 37 74 185 


321 


3 107 


371 


7 53 


322 


2 7 14 23 46 161 


372 


234612316293 124 186 


323 


17 19 


373 


2 U 17 22 34 187 


324 


2346912182736 54 81 


374 




108 162 


375 


3 5 15 25 75 125 


325 


5 13 25 65 


376 


2 4 6 47 94 188 


326 


2 163 


377 


13 29 


327 


3 109 


378 


2 3 6 7 9 l 4 18 21 27 42 54 63 


328 


2 4 8 4 l 82 164 




126 


329 


7 47 


379 


2 4 5 10 19 20 38 76 95 190 


330 


2 3 5 6 10 11 13 22 30 33 55 66 


380 




110 165 


381 


3 127 


331 




382 


2 191 


332 


2 4 83 166 


383 




333 


3 9 37 in 


384 


234681216 24 32486496 


334 


2 167 


385 


128 


335 


5 67 


5 7 11 35 55 77 


336 


23467812141621 24 28 1 i 248 


386 


2 193 


56 84 112 168 


387 


3 9 43 129 


337 


388 


2 4 97 194 


338 


2 13 26 169 


389 


2 3 5 6 10 13 15 26 30 39 65 


339 


3 113 


390 


340 


2 4 5 10 17 20 34 68 84 170 




78 130 195 


341 


11 31 


393. 


17 23 


342 


2 3 6 9 18 19 38 57 H 4 171 


392 


2 4 7 8 14 28 49 56 98 196 


343 


7 49 


393 


3 131 


344 


2 4 8 43 86 172 


394 


2 197 


345 


3 5 15 23 69 115 


395 


5 79 


346 


2 173 


396 


2346911121822 33 36 44 


347 


2 3 4 6 12 29 58 87 116 174 




66 99 132 198 


348 


397 




349 




398 


2 199 


350 


2 5 7 10 14 25 35 50 70 175 


399 


3 7 19 21 57 133 


351 


3 9 13 27 39 117 


400 


245810162025405080 








100 200 


-eOWFTTOBWTTAT. _ 420 
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H. liable of prlaea up to 2000 



1 


139 


337 


557 


769 


1013 


1249 


1493 


1741 


2 


149 


347 


563 


773 


1019 


1259 


1499 


1747 


3 


151 


349 


569 


787 


1021 


1277 


1511 


1753 


5 


157 


353 


571 


797 


1031 


1279 


1523 


1759 


7 


163 


359 


577 


809 


1033 


1283 


1531 


1777 


11 


167 


367 


587 


811 


1039 


1289 


1543 


1783 


13 


173 


373 


593 


821 


1049 


1291 


1549 


1787 


17 


179 


379 


599 


623 


1031 


3297 


1553 


1789 


19 


181 


383 


601 


827 


1061 


1301 


1559 


1801 


23 


191 


389 


607 


829 


1063 


1303 


1567 


IBU 


29 


193 


397 


613 


839 


1069 


1307 


1571 


1823 


31 


197 


4oi 


617 


853 


1087 


1319 


1579 


1831 


37 


199 


409 


619 


857 


1091 


1321 


1583 


1847 


kL 


211 


419 


631 


859 


1093 


1327 


1597 


1861 


43 


223 


421 


64 l 


863 


1097 


1361 


1601 


1867 


47 


227 


431 


643 


877 


1103 


1367 


1607 


1871 


53 


229 


433 


647 


881 


1109 


1373 


1609 


1873 


59 


233 


439 


653 


883 


1117 


1381 


1613 


1877 


61 


239 


443 


659 


887 


1123 


1399 


1619 


1879 


67 


24 l 


449 


661 


907 


1129 


1409 


1621 


1889 


71 


251 


457 


673 


911 


1131 


1423 


1627 


1901 


73 


257 


^1 


677 


919 


1153 


1427 


1637 


1907 


79 


263 


463 


683 


929 


1163 


1429 


1657 


1913 


83 


269 


467 


691 


937 


1171 


1433 


1663 


1931 


89 


271 


479 


701 


941 


U6l 


1439 


1667 


1933 


97 


277 


487 


709 


947 


1187 


1447 


1669 


1949 


101 


281 


491 


719 


953 


1193 


1491 


1693 


1951 


103 


283 


499 


727 


967 


1201 


1453 


1697 


1973 


107 


293 


503 


733 


971 


1213 


1459 


1699 


1979 


109 


307 


509 


739 


977 


1217 


1471 


1709 


1987 


113 


311 


521 


743 


983 


1223 


l48l 


1721 


1993 


127 


313 


523 


751 


991 


1229 


1483 


1723 


1997 


131 


317 


541 


757 


997 


1231 


1487 


1733 


1999 


137 


331 


547 


761 


1009 


1237 


1489 
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I. Four-place 



10 0000 0043 0086 0126 0170 

11 04 l 4 o 4 S 3 0492 0331 0369 

12 0792 0626 0864 0 ^ 093 ^ 

13 1139 1173 3206 1239 1271 

14 l 46 l 1492 1323 1333 1384 

13 1761 1790 1616 1847 1873 

16 204 i 2068 2093 2122 2148 

17 2304 2330 2333 2380 2403 

18 2333 2377 2601 2623 2648 

19 2788 2810 2833 2836 2878 

20 3010 3032 3073 3096 

21 3222 3243 3263 32 ^ 3304 

22 3 <i 24 31 A 4 3 >t 64 3 >t 83 3302 

23 3617 3636 3633 367 >» 3692 

24 3802 3820 3836 3836 3874 

23 3979 3997 ^t 0 l 4 4031 4 o 48 

26 4130 4166 4183 4200 4216 

27 4314 4330 4346 4362 4378 

28 4472 4487 4502 4516 4333 

29 4624 4639 4654 4669 4683 

30 4771 4786 4800 48 l 4 4829 

31 4914 4928 4942 4933 4969 

32 5051 5065 5079 3092 5105 

33 3183 3198 3211 32 ^ 3237 

34 5313 3328 5340 5333 3366 

35 3441 5433 3465 5478 5490 

36 5563 3373 3587 3399 36 n 

37 3682 5694 3703 3717 3729 

38 3798 3809 5821 3832 5843 

39 3911 3922 5933 3944 5953 

4 0 6021 6031 6042 6053 6064 

41 6128 6138 6149 6160 6170 

42 6232 6243 6253 6263 6274 

43 6335 6345 6355 6365 6375 

44 6433 6444 6454 6464 6474 

45 6532 6542 6531 6561 6571 

46 6628 6637 6646 6656 6665 

47 6721 6730 6739 6749 6738 

48 6812 6821 6830 6839 6 ^ 

49 6902 6911 6920 6928 6937 

50 6990 6998 7007 7016 7024 

51 7076 7^ 7093 7101 7110 

52 71& 7168 7177 7185 7193 

53 7243 7251 7259 7267 7275 

54 7324 7332 7340 7348 7356 



8 9 



0719 0755 
0969 1004 1038 1072 1106 
1303 1333 1367 1399 1430 
I6l4 1644 1673 1703 1732 



1903 1931 
2175 2201 
2430 2455 
2672 2693 
2900 2923 

3118 3139 
3324 3345 
3322 3541 

3711 3729 

3892 3909 



1939 1987 2014 
2227 2253 2279 
2480 25^ 2529 
2718 2 ^ 2165 
2945 2967 2969 

3160 3181 3201 
3365 3385 34 o 4 
3560 3579 3598 
3747 3766 3784 

3927 3945 3962 



4065 4082 4099 4ai6 4133 
42^ 4249 4265 4281 4298 
4393 4409 4425 4440 4456 
4548 4564 4579 4594 4609 
4698 4713 4728 4742 4757 



4843 4857 

4983 4997 

5119 5132 
5250 5263 
5378 5391 



4871 4866 4900 
5011 5024 5038 
5145 5159 5172 
5276 3289 3302 
5403 3416 3428 



5502 5514 5527 5539 5551 
5623 3635 5647 5638 5670 
5740 5752 5763 5775 3786 

5855 5866 5877 5888 5899 

5966 5977 5988 5999 6010 

6073 6085 6096 6107 6117 
6180 6191 6201 6212 6222 
6284 6294 6304 6314- 6323 
6383 6393 6405 6415 6425 
6484 6493 6503 6513 6522 



6580 6590 
6673 6684 
6767 6776 
6857 6866 

6946 6953 

7033 7042 
7118 7126 
7202 7210 
7284 7292 
7364 7372 



6599 6609 6618 
6693 6702 6712 

6785 6794 6803 
6873 6864 6893 
6964 6972 6981 

7050 7059 7067 
7135 7143 7152 
7218 7226 7233 
7300 7308 7316 
7380 7388 7396 



Piopoitlonal Pans 

345678 



8 12 17 21 25 29 33 37 
4 8 11 15 19 23 26 30 34 
3 7 10 14 17 21 24 26 31 
3 610131619232629 
3 6 9121518212427 

3 6 8 11 14 17 20 22 25 
3 5 6111316162124 
2 5 7101215172022 
2 5 7 912lAl6l9 21 
2 4 7 9111316 18 20 

2 4 6 6 U 13 15 17 19 
2 4 6 B10 12 14 i 6 i 8 
2 4 6 8 10 12 l4 15 17 
2 4 6 7 91113 15 17 
2 4 5 7 911121416 

2 3 3 7 9 10 1214 15 
2 3 3 7 8101113 13 
233669111314 
233689111214 
1 3 46 7 9101213 

134679 10 1113 
134678101112 
13457891112 
13456891012 
13456891011 

12456791011 
12456781011 
123 56789 10 
1233678910 
12345769 10 

1234568910 

123456789 

123456789 

123456789 

123456789 

123456789 

123456778 

123453678 

123445678 

123445678 

123345678 

123345678 

122345677 

122345667 

122345667 
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55 1 7 ^ 7*19 71127 7^^35 7*A3 7^51 7>»59 7 k 66 7^^7^^ 1223^5567 

56 7*82 7*90 7*97 7505 7513 7520 7528 7536 75*3 7551 12 2 3 * 5 5 6 7 

57 7559 7566 757* 7582 7589 7597 760* 7612 7619 7627 1 2 2 3 * 5 5 6 7 

58 763* 7^ 7^9 '^57 7^ 7672 7679 T 6 B 6 769* 7701 1123**5 6 7 

59 7709 7716 7723 7731 7738 77*5 7752 7760 7767 777* 1123**567 

60 7782 7789 7796 7803 7810 7818 7825 7832 7839 78*6 1123**566 

61 7853 7860 7868 7875 7882 7889 7896 7903 7910 7917 1123**566 

62 792* 7931 7938 79*5 7952 7959 7966 7973 7980 7987 11233*566 

63 7993 8000 8007 80U 8021 8028 8035 80*1 80*6 8055 11233*556 

6* 8062 8069 8075 8082 8089 8096 8102 8109 8116 8122 11233*556 

65 8129 8136 81*2 81*9 8156 8162 6169 8176 8182 8189 11233*556 

66 8195 8202 8209 8215 8222 8228 8235 82*1 82*8 825* 112 3 3 * 5 5 6 

67 8261 8267 827* 8280 8287 8293 8299 8306 8312 8319 11233*556 

66 6325 8331 8338 83** 8351 8357 8363 6370 8376 8382 11233**56 

69 8388 6395 8*01 Skvi 8*1* 8*20 8*26 8*32 6*39 8**5 11223**56 

70 8*51 8*57 8*63 8*70 8*76 8*82 8*86 6*9* 6500 8506 11223**56 

71 8513 8519 8525 8531 8537 85*3 85*9 8555 8561 8567 11223**55 

72 8573 8579 8585 8591 8597 8603 8609 8615 6621 8627 11223**55 

73 8633 8639 86*5 8651 8657 8663 8669 8675 8681 8686 112 2 3**55 

7* 8692 8698 870* 8710 8716 8722 8727 8733 8739 87*5 11223**55 

75 8751 8756 8762 8768 877* 8779 8785 8791 8797 8802 112233*55 

T 6 8808 881* 6820 6825 8831 8837 88*2 88*6 885* 8859 112233*55 

77 8865 8871 8876 8882 88^ 8893 8899 890* 89IO 8915 112233**5 

78 8921 89^ 8932 8938 89*3 89*9 895* 6960 8^5 8971 112233**5 

79 8976 ^82 8987 6^ 899B 900* 9009 9CXL5 9020 9025 112 2 3 3**5 

80 9031 9036 90*2 90*7 9053 9058 9063 9069 907* 9079 112233**5 

81 9085 9090 9096 9101 9106 9U2 9117 9122 91^ 9133 112233**5 

82 9138 91*3 91*9 915* 9159 9165 9170 9175 9160 9186 112233**5 

83 9191 9196 9201 9206 9212 9217 9222 9227 9232 9238 112233**5 

8* 92*3 92*8 9253 9258 9263 9269 927* 9279 928* 9269 112233**5 

85 929* 9299 930* 9309 9315 9320 9325 9330 9335 93*0 112233**5 

86 93*5 9350 9355 9360 9365 9370 9375 9380 9385 9390 112 2 3 3**5 

87 9395 9*00 9*05 9*10 9*15 9*20 9*25 9*30 9*35 9*to 0112233** 

88 9>^5 9*50 9*55 9*60 9*65 9*69 9*7* 9*79 9*8* 9*89 0112233 ** 

89 9*9* 9*99 95^ 9509 9513 9518 9523 9528 9533 9536 0112 2 3 3** 

90 95*2 95*7 9552 9557 9562 9566 9571 9576 9581 9586 0112233 ** 

91 9590 9595 9600 9605 9609 961* 9619 962* 9628 9633 0112233 ** 

92 9636 9^3 96*7 9652 9657 9661 9666 9671 9675 9680 0112233** 

93 9685 9689 969* 9699 9703 9708 9713 9717 9722 9727 0 1 1 2 2 3 3 * * 

9* 9731 9736 97*1 97*5 9750 975* 9759 9763 9768 9773 0112 2 3 3 ** 



95 9777 9782 9786 9791 9795 

96 9823 9627 9632 9836 98*1 

97 9868 9872 9877 9881 9886 

98 9912 9917 9921 9926 9930 

99 9956 9961 9965 9969 997* 



9800 9805 9809 961* 9818 
98*5 9850 985* 9859 9863 
9890 989* 9699 9903 9908 

993* 9939 99*3 99*8 9952 
9978 9983 9967 9991 9996 



0112233** 

0112233** 

0112233** 

0112233** 

01122333* 
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REPEA3SD AT VARIOUS JKDBRVAIS 
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^OHPiDmniAL 



LIST OF HOBDB CONTAINING LIKE ISTTEB8 
RBFEAXED AX VARIOUS imBRVAIS 



AA 


RU BBER 


AA 


RU BBLE 


AA 


A CCEPT 


AA 


A CCEPTABLE 


AA(5)A 


A CCEPTANCE 


AA 


A CCESS 


AA 


A CCESSORY 


AA 


A CCIDENTAL 


AA 


A CCOMPANY 


AA 


A CCOMUODATION 


AA(5)A 


A CCORDANCE 


AA 


A CCORDING 


AA 


0 CCUPATION 


AA 


0 CCUPY 


AA 


SU CCEEDED 


AA 


SU CCESS 


AA 


SU CCESSFUL 


AA 


SU CCESSFULLY 


AA 


SU CCESSIVE 


AA 


TOBA CCO 


AA 


UNSU CCESSFUL 


AA 


A DD 


AA 


A DDITIONAL 


AA 


A DDRESSES 


AA 


A DDRESS 


AA(5)A 


A DDRESSED 


AA 


BE DOING 


AA 


LA ODER 


AA 


SU DDEN 


AA(1)A 


AGR EEHENT 


AA 


B EEN 


AA(1)A 


BEENN EEDED 


AA(2)AA(1)A 


B EENNEEDED 


AA(2)A 


B EETLE 


AA 


BETW EEN 


AA(1)A 


BR EEZE 


AA(1)A 


CH EESE 


AA 


COFF EE 


AA 


COMMAND EER 


AA 


COMMITT EE 



AA 


CR EEK 


AA 


DECR EE 


AA 


DEGR EE 


AA 


EIGHT EEN 


AA 


EIGHT EENTH 


AA 


EMPLOY EE 


AA 


ENGIN EER 


AA 


ENGIN BERING 


AA 


F EEL 


AA 


F eET 


AA 


FIFT EEN 


AA 


FIFT EENTH 


AA 


FL EiE 


AA 


FL EET 


AA 


FOURT EEN 


AA 


FOURT EENTH 


AA 


HASB EEN 


AA 


HAVEB EEN 


AA 


IND EED 


AA 


K EEP 


AA(1)A 


K EEPER 


AA 


M EET 


AA 


NINET EEN 


AA 


NINET EENTH 


AA 


PROC EED 


AA(1)A 


PROC EEDED 


AA 


QU EEN 


AA(5)A 


R EENFORCE 


AA(5)A(1)A 


R EENFORCEHENT 


AA 


R EENLIST 


AA(5)A 


R EENLISTED 


AA(6)A 


R EENLISTMENT 


AA 


REFUG EE 


AA 


SCR EEN 


AA 


SCR EENING 


AA 


S EE 


AA 


S EEN 


AA 


SEVENT EEN 


AA 


SEVENT EENTH 


AA 


SIXT EEN 
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AA 


SIXT 


EENTH 


AA 


ACTUA 


LLY 


AA 


SMOKESCR 


EEN 


AA 


A 


LL 


AA 


SP 


EED 


AA 


A 


LLEGE 


AA 


ST 


EEL 


AA 


A 


LLEGIANCE 


AA 


STR 


eet 


AA 


A 


LLIED 


AA(1)A 


SUCC 


EEDED 


AA 


A 


LLIES 


AA 


SW 


EEPING 


AA 


A 


LLOCATION 


AA 


THIRT 


EEN 


AA 


A 


LLOTUENT 


AA 


THIRT 


EENTH 


AA 


A 


LLOVANCE 


AA 


THR 


EE 


AA 


A 


LLOW 


AA 


W 


EEK 


AA 


A 


LLY 


AA 


WH 


EEL 


AA 


ARTI 


T.T.RRY 


AA 


A 


FFAIR 


AA 


BA 


LLISTICS 


AA 


CHAU 


FFEUR 


AA 


BA 


LLOON 


AA 


COE 


FFICIENT 


AA 


BE 


LLIGERENT 


AA 


CO 


FFEE 


AA 


BI 


LLET 


AA 


DI 


FFERENCE 


AA 


BI 


LLETED 


AA 


DI 


FFERENT 


AA 


BU 


LLETIN 


AA 


DI 


FFICULT 


AA 


CA 


LL 


AA 


DI 


FFICULTIES 


AA 


CANCE 


LLATION 


AA 


E 


FFECT 


AA 


CANCE 


LLED 


AA 


E 


FFECTED 


AA 


CE 


LL 


AA 


E 


FFECTIVE 


AA 


CHA 


LLENGE 


AA 


E 


FFICACY 


AA 


CO 


LLAPSED 


AA 


E 


FFICIENT 


AA 


CO 


LLECT 


AA 


E 


FFICIENCY 


AA 


CO 


LLECTION 


AA 


ET 


FFORT 


AA 


CO 


LLEGE 


AA 


GENERALSTA 


FF 


AA 


CO 


LLISION 


AA 


INE 


FFICIENCY 


AA 


COUPE 


LLED 


AA 


JUUPO 


FF 


AA 


DISTI 


LL 


AA 


0 


FF 


AA 


DO 


LLAR 


AA 


0 


FFEND 


AA 


DRI 


LL 


AA 


0 


FFENDED 


AA 


ENRO 


LL 


AA 


0 


FFENSE 


AA 


ENRO 


LLED 


AA 


0 


FFENSIVE 


AA 


ENRO 


LLMENT 


AA 


0 


FFICE 


AA 


EXPE 


LLED 


AA 


0 


FFICER 


AA 


FA 


LL 


AA 


0 


FFICIAL 


AA 


FA 


LLING 


AA 


POSTO 


FFICE 


AA 


FE 


LL 


AA 


STA 


FF 


AA 


FI 


LLING 


AA 


SU 


FFER 


AA 


FO 


LLOW 


AA 


SU 


ffered 


AA 


FU 


LL 


AA 


SU 


FFICIENT 


AA 


HI 


LL 


AA 


TRA 


FFIC 


AA 


I 


LL 


AA(1)A 


BA 


G6AGE 


AA(3)A 


I 


LLEGAL 


AA 


FO 


GGY 


AA 


I 


LLITERATE 


AA 


STRA 


GGLER 


AA 


I 


LLNESS 


AA 


SU 


GGEST 


AA 


I 


LLUUINATE 


AA 


TRI 


GGER 


AA 


I 


LLUHINATING 


AA 


BEAC 


HHEAD 


AA 


I 


LLUUINATION 
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umurmNTJLAi: 



AA 


I LLUSTRATE 


AA 


CO 


HMENT 


AA 


I LLUSTRATION 


AA 


CO 


MHEiRCE 


AA 


INSTA LL 


AA 


CO 


MHISSARY 


AA 


INSTA LLATIONS 


AA 


CO 


MMISSION 


AA 


INTE LLIGENCE 


AA 


CO 


HMISSIONER 


AA 


INTE LLIGENT 


AA 


CO 


MHIT 


AA 


KI LLED 


AA(2)A 


CO 


HMITUENT 


AA 


KI LLING 


AA 


CO 


MUITTEE 


AA 


MI LLIMETER 


AA 


CO 


HMON 


AA 


HISCE LLANEOUS 


AA 


CO 


MHUNICATE 


AA 


OSCI LLATE 


AA 


CO 


MMUNICATION 


AA 


PARA LLAX 


AA 


CO 


HMUNIQUE 


AA(1)A 


PARA LLEL 


AA 


CO 


MMUTE 


AA 


PATRO LLING 


AA 


HA 


HMEjR 


AA 


PAYRO LL 


AA 


I 


MMEDIATE 


AA 


RA LLY 


AA 


I 


MMIGRATION 


AA 


REBE LLION 


AA 


INFLA 


MMABLE 


AA 


REFI LL 


AA 


RECO 


MHEND 


AA 


REFI LLING 


AA 


RECO 


MMENDATION 


AA 


REPE T.T.m 


AA 


RECO 


HMENDED 


AA 


RESPECTFU LLY 


AA 


SU 


MHARY 


AA 


SHE LL 


AA 


SU 


HMER 


AA 


SHE LLED 


AA 


SU 


MMIT 


AA 


SHE LLFIRE 


AA 


SU 


HMON 


AA 


SHE LLING 


AA 


SWI 


MMING 


AA 


SHE LLS 


AA 


A 


NNEX 


AA 


SIGNA LLING 


AA 


A 


NNOUNCE 


AA 


SNA LL 


AA(2)A(4)A 


A 


NNOUNCEHENT 


AA 


SPE LL 


AA 


A 


NNUAL 


AA 


SUCCESSFU LLY 


AA 


ANTE 


NNA 


AA 


VA LLEY 


AA 


BA 


NNER 


AA 


VI LLAGE 


AA 


BEE 


NNEEDED 


AA 


WE LL 


AA(1)A 


BEGI 


NNING 


AA 


WI LL 


AA 


CA 


NNOT 


AA 


WI LLATTACK 


AA 


CHA 


NNEL 


AA 


WI LLIAH 


AA(4)A 


CO 


NNECTING 


AA 


ACCO MMODATION 


AA(5)A 


CO 


NNECTION 


AA 


A MHETER 


AA 


GU 


NNER 


AA 


A HMUNITION 


AA 


HA 


NNER 


AA 


CO HHA 


AA(1)A 


HA 


NNING 


AA 


CO MHAND 


AA 


PERSO 


NNEL 


AA 


CO MHANDANT 


AA(1)A 


PLA 


NNING 


AA 


CO HMANDED 


AA(5)A 


RECO 


NNAISSANCE 


AA 


CO MMANDEER 


AA 


RECO 


NNOITER 


AA 


CO MHANDER 


AA(6)A 


RECO 


NNOITERING 


AA 


CO HMANDING 


AA 


RU 


NNER 


AA 


CO MHEjNCE 


AA(1)A 


RU 


NNING 


AA(4)A 


CO HMENCEMENT 


AA 


TO 


NNAGE 


AA 


CO MHEND 


AA 


AFTERN 


OON 


AA 


CO MMENDATION 


AA 


ASS 


OONAS 
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AA 


BALL 


OON 


AA 


A 


PPROXIMATE 


AA 


B 


OOK 


AA 


CLI 


PPER 


AA 


B 


DOTH 


AA 


DISA 


PPEAR 


AA 


CODEB 


OOK 


AA 


DISA 


PPEARANCE 


AA 


C 


OOK 


AA 


DISA 


PPEARED 


AA 


C 


OOPERATE 


AA 


DRO 


PPED 


AA(6)A 


C 


OOPERATION 


AA 


HA 


PPEN 


AA 


C 


OORDINATE 


AA 


MA 


PPING 


AA(7)A 


C 


OORDINATION 


AA 


0 


PPOSE 


AA(2)A 


F 


OOTHOLD 


AA 


0 


PPOSITE 


AA 


FOREN 


OON 


AA 


0 


PPOSITION 


AA 


H 


OOK 


AA 


PHILI 


PPINES 


AA 


L 


OOK 


AA 


REA 


PPOINTED 


AA(1)A 


L 


OOKOUT 


AA 


REA 


PPOINTUENT 


AA 


N 


OON 


AA 


SHI 


PPING 


AA 


PLAT 


OON 


AA 


STO 


PPED 


AA 


PONT 


OON 


AA 


SU 


PPLIES 


AA 


PR 


OOF 


AA 


SU 


PPLY 


AA 


SCH 


OOL 


AA 


SU 


PPORT 


AA 


SCH 


OOLHOUSE 


AA 


SU 


PPORTING 


AA 


SHARPSH 


OOTER 


AA 


SU 


PPOSE 


AA 


S 


OON 


AA 


A 


RRANGE 


AA 


SP 


OOLS 


AA 


A 


RRANGEUENT 


AA 


SP 


OONS 


AA 


A 


RREST 


AA 


TATT 


00 


AA 


A 


RRESTED 


AA 


T 


00 


AA 


A 


RRIVAL 


AA 


T 


OOK 


AA 


A 


RRIVE 


AA 


T 


OOL 


AA 


BA 


RRACKS 


AA 


TR 


OOPS 


AA 


BA 


RRAGE 


AA 


TR 


OOPSHIP 


AA 


CA 


RRIAGE 


AA 


TR 


OOPSHIPS 


AA(2)A 


CA 


RRIER 


AA 


UNDERST 


OOD 


AA 


CA 


RRY 


AA 


W 


OODED 


AA 


CONFE 


RRED 


AA 


W 


OODS 


AA 


CO 


RRECT 


AA 


AIRSU 


PPORT 


AA 


CO 


ERECTED 


AA 


A 


PPARATUS 


AA 


CO 


ERECTION 


AA 


A 


PPARENT 


AA 


CO 


RRECTNESS 


AA 


A 


PPARENTLY 


AA 


CO 


RRESPONDENCE 


AA 


A 


PPEAR 


AA 


CO 


RRESPONDING 


AA 


A 


PPEARANCE 


AA(3)A 


CO 


RRIDOR 


AA 


A 


PPEARED 


AA 


CU 


RRENT 


AA 


A 


PPLICATION 


AA 


DEFE 


RRED 


AA 


A 


PPLY 


AA 


DE 


RRICK 


AA 


A 


PPOINT 


AA(1)A 


E 


RROR 


AA 


A 


PPOINTED 


AA 


FE 


RRY 


AA 


A 


PPOINTUENT 


AA 


GA 


RRISON 


AA 


A 


PPROACH 


AA 


HU 


RRICANE 


AA(2)A 


A 


PPROPRIATE 


AA 


INTE 


ERUPT 


AA 


A 


PPROVAL 


AA 


INTE 


ERUPTED 


AA 


A 


PPROVE 


AA 


INTE 


ERUPTION 
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AA(5)A 


I RREGULAR 


AA 


CARELESSNE 


SS 


AA(5)A 


I RREGULARITIES 


AA(1)A 


CHA 


SSIS 


AA(5)A 


I RREGULARITY 


AA 


CLA 


SSIFICATION 


AA 


I RRIGATION 


AA 


COHMI 


SSARY 


AA(1)A 


MI RROR 


AA 


COMMI 


SSION 


AA 


PREA RRANGED 


AA 


COHMI 


SSIONER 


AA 


PREFE RREO 


AA 


COHPA 


SS 


AA(4)A 


SU RRENDER 


AA 


GOMPLETENE 


SS 


AA(4)A 


SU RRENDERED 


AA 


COMPRE 


SSED 


AA 


SU RROUND 


AA 


CONCE 


SSION 


AA 


TE RRAIN 


AA 


CONFE 


SSION 


AA 


TE RRIBLE 


AA 


CONGRE 


SS 


AA 


TE RRIFIC 


AA 


CONGRE 


SSIONAL 


AA(3)A 


TE RRITORY 


AA 


CORRECTNE 


SS 


AA(1)A 


TE RROR 


AA 


CRO 


SS 


AA 


TOMO RROW 


AA 


CRO 


SSING 


AA 


TRANSFE RRED 


AA(4)A 


CRO 


SSROADS 


AA 


TRANSFE RRING 


AA 


DARKNE 


SS 


AA 
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